Don't Click. Stop. Think.

There are those sentences that make technical colleagues question whether an Awareness professional's job is even necessary in an average security environment — because if these sentences get drilled into every employee's head once a year, that satisfies whatever compliance thinks education can add to the human layer. (I've had plenty of the opposite experience too, but the "users are idiots" view still makes up the bigger share regardless.)

Don't click. Stop. Think.

It's become so worn out that most people just nod along, then open the attachment anyway, because they're rushing to a meeting. For years I lived and worked in the shadow of this spoken/unspoken prejudice: my mission was to mobilize every bit of communication, education, and behavioral-psychology knowledge available to me, to get people to update their own ingrained cognitive patterns so that these three sentences would produce REAL action (and non-action) and REAL behavior change.

(I spent seven years as Information & Cyber Security Engagement Lead in my previous role, before this sounds too dry to anyone: I was responsible for teaching nearly thirty thousand differently-wired colleagues, regularly targeted by different kinds of attacks, how to make the right decisions. I loved it.)

When my team grew and I had the chance to hand practical creation over to other capable hands, I got the opportunity to look at the topic from above, and slowly a system took shape that could be named (and since it has "firewall" in the name, hopefully that's a metaphor that lands well with the IT community too, making it easier to hand off as well.)

May I show you?

The three firewalls, as I came to know them on the cyber frontline.

The first is the Attentional, or Perceptual firewall:
do you even notice that something unusual is happening. The vast majority of phishing emails don't get through because someone is stupid. They get through because someone is tired, in a hurry, and their attention is already on the next task. This is where the "gut" instincts show up. That small, uncomfortable feeling.

The second is the Interpretation firewall:
if you noticed something is off, do you interpret it correctly. The "Urgent, pay this now" email works because the confident, authoritative tone overrides suspicion. We don't believe something because we verified it. We believe it because it sounded like something a CEO would say. This is where the capacity for critical thinking comes into play.

The third is the Decision firewall:
and even if you interpreted it correctly, do you make the right decision, or do you take the easiest path because your brain doesn't want to make one more judgment call that day.

Although life didn't work out so that I got to put this system into practice while still in that role, I knew exactly what I would have done — given all three equal focus. It's not enough to target just one of these. If you sharpen attention alone but don't address decision fatigue, you end up right back where you started. All three need to be up at the same time — otherwise there will always be a hole something slips through.

When it turns out this isn't just about defense against hackers

And here's the part that sounded strange to me at first too, I sat with it for a while myself: once we step away from malicious intent — meaning, away from someone deliberately trying to scam you — the same three steps still play out in our brains when we're talking to a generative AI. Not because ChatGPT or Claude is malicious. But because your brain genuinely can't tell the difference between what or who is trying to think for you: a phishing email, or a helpful AI assistant giving you exactly the answer you wanted to hear.

Both are an external influence that walks you through a process, where at some point you hand over control.

To be clear: a conversation with an AI is not the same as a scam. But the three checkpoints where your attention, your interpretation, and your decision get settled stay exactly the same in every single interaction. And that's precisely why I think this will be the next evolutionary step — the threshold where it gets decided whether we keep what I call cognitive sovereignty: consciously deciding what we hand over from our thinking, and what we keep for ourselves.

The cognitive gym nobody signed up for

I have an image in my head about this that I can't shake: it won't take long before cognitive gyms start opening up everywhere. Seriously. The same thing happens as when you get home tired in the evening, and instead of cooking something, you open the food delivery app and order junk food. Not because you don't know what's good for you. Because under time pressure, tired, you take the path of least resistance — and that's exactly what your brain does to you too, when you simply hand the harder part of thinking over to GenAI.

Simply because it's easier. Or because the sycophancy effect, combined with the seemingly brilliant connections fed straight into your mouth, means your dopamine-soaked brain can't make a rational decision. "Damn, I came up with that!" seasoned with built-in praise isn't an experience you can just walk away from easily.

Just like with the body: if you keep choosing the easier option often enough, that mental muscle — the one responsible for actually thinking something through yourself — starts to atrophy. Not overnight — gradually, imperceptibly, the way a habit forms. (More and more research is coming out about this, by the way, about the relationship between habituation and human will — I'll come back to that in a future piece.)

So yes: we're going to need cognitive gyms. Not because AI is bad. Because what we call healthy in our own thinking now — based on my own experience and the data that's trickling in — needs to be consciously maintained from now on, the same way we maintain the body. This cognitive work never came for free before either — we just never had such a convenient tool that could do it for us this well.

---

The three firewalls I learned to design in the security awareness world are now turning into something else: not primarily a tool against scams, but the framework for keeping your own judgment intact while working alongside increasingly intelligent systems. Because we need to talk about this, we need to bring the process of metacognition down into an understandable space, unpack the box around the concept of critical thinking, and shape it into practical, buildable systems — coating the bitter pill nicely so we put our own brains to work that much more.

The plan, then, is that in the next piece I'll go through what recent research says: what happens to our metacognition when AI improves our performance, why verification becomes the new bottleneck, and how to calibrate trust instead of blindly following or blindly rejecting AI.

This is more than a luxury topic — it's the next basic skill, and who knows, maybe an evolutionary step too.