When we think about cybersecurity, we usually think about patch updates. But the arrival of generative AI has shifted the battlefield directly to human reasoning.
AI makes us vulnerable not because it hacks our systems, but because it hacks our habits. It creates a psychological trap through three main threats:
- Weaponized Persuasion: Attackers can now use AI to generate highly personalized, adaptive deceptions (like ultra-convincing spear-phishing) that easily bypass standard human suspicion.
- Plausible Hallucinations: AI tools confidently spit out fabricated information that looks completely legitimate during a quick skim.
- Cognitive Offloading: Because AI is so fast, employees naturally stop doing independent thinking. They offload the mental heavy lifting to the machine and blindly accept its conclusions.
To fight this, Yuksel Aydin (CISO at RSM France) developed a dead-simple, three-minute training protocol called “Think First, Verify Always” (TFVA). It treats AI as a powerful assistant that requires constant supervision, not an absolute authority that demands obedience.
The TFVA Process Breakdown
The beauty of this framework is that employees don’t need to recognize that they are being manipulated for it to work. They just need to follow two strict behavioral habits:
1. Think First
Before you even open an AI tool or look at a generated report, form your own independent judgment. Outline what you expect the answer to look like, or sketch out your own solution framework first. This stops the AI from “anchoring” your brain and biasing your perspective with its own confidently generated direction.
2. Verify Always
Never pass an AI output up the ladder or execute a request without cross-checking critical data against completely independent, non-AI sources. Treat every AI claim like an unverified rumor until you can back it up with hard evidence.
Does a Three-Minute Lesson Actually Work?
It sounds almost too simple to be effective, but the data proves otherwise. In a randomized controlled trial tracking participants across 18 high-risk scenarios (like spotting advanced phishing or fake executive data requests), a brief three-minute micro-lesson on TFVA yielded massive security gains
Overall Decision Quality
- Improvement: Increased by 7.87 percentage points
Ethical Judgment
- Improvement: 44% relative improvement
Information Verification
- Improvement: 25% boost in active fact-checking
Real-World Rollout: RSM France successfully deployed this exact three-minute framework across its entire onboarding and training pipeline for 1,600 employees, proving that heavy-duty cognitive defense doesn’t require hours of boring slide decks.
Managers can easily bake this protocol into standard generative AI access policies or weekly team syncs. The goal isn’t to make employees fear AI, it’s to make sure they keep their hands firmly on the steering wheel.
