izusek/Getty Images
Of the potential weaknesses of any security system, the human layer has always posed a key risk. The arrival of AI tools has made human cognition even more of a vulnerability.
Companies face three overlapping security threats from AI’s effects on human cognition. First, weaponized persuasion lets attackers manipulate employees’ judgment through personalized, adaptive deception. Second, plausible hallucinations deliver confidently false information that survives casual review. And third, as employees offload cognitive work to AI systems, they engage in less independent reasoning. Together, these dynamics make humans both the primary vulnerability and the key defense.
A simple new protocol dubbed “Think First, Verify Always” (TFVA) addresses these threats by urging employees to take two steps. “Think First” requires employees to form their own judgment before consulting AI. “Verify Always” requires that they cross-check critical AI-generated information against independent sources before acting. The protocol aims to bolster independent judgment and verification and reduce risk, even when manipulation goes unrecognized.
This simple, structured critical-thinking habit can effectively reduce AI risk. In a randomized controlled trial with 151 participants, a three-minute micro-lesson on TFVA improved decision quality by 7.87 percentage points, with a 44% relative improvement in ethical judgment and 25% improvement in information verification. After the micro-lesson, participants were tested on 18 scenario-based tasks (like spotting AI-generated phishing and suspicious executive requests) and scored 65.3%, compared with 57.4% for a control group.
At RSM France, the audit, accounting, and consulting firm where I work, we deployed the protocol in onboarding and training programs for our 1,600 employees. Early feedback suggests that it reduces risk and builds organizational trust.
Managers can embed TFVA in onboarding, security awareness training, and generative AI access policies and reinforce the habit in each instance with a simple three-minute training session. The return is a workforce that treats AI as a powerful tool requiring judgment, not a trusted authority requiring obedience.