Cybersecurity starts from an uncomfortable premise: systems fail where assumptions meet reality. Humans are not computers, but the same discipline gives us a useful metaphor. We have an attack surface too.
Not because people are stupid. Quite the opposite. We evolved to care about belonging, reputation, threats, reciprocity, sex, status and the behaviour of the group around us. Those are useful systems. They are also inputs.
Modern platforms do not need to understand your soul. They only need enough feedback to learn which inputs keep your attention.
The exploit does not have to look hostile
A phishing email looks suspicious because we already know the genre. Persuasion is harder to notice when it looks like entertainment, friendship, moral outrage or common sense.
A feed can learn that you stop scrolling when you see conflict. An influencer can learn that certainty gets more engagement than nuance. A political account can learn that humiliation travels further than policy detail. None of those actors need to coordinate.
The system only needs a measurable output.
That is why the phrase “the algorithm is manipulating you” is simultaneously useful and too simple. Algorithms optimise targets. Humans choose targets, business models create incentives, communities reward particular behaviour and users feed the loop with their own preferences.
There may be no mastermind. There can still be an outcome.
The human vulnerabilities are ordinary
Research on adolescents and social media increasingly focuses on mechanisms rather than a crude count of hours. A 2024 review in Nature Reviews Psychology describes pathways involving social comparison, self-presentation, social feedback, exclusion, reward processing and stress sensitivity.
That distinction matters. “Screen time” puts video calls with a grandparent, doomscrolling at 02:00, group chat harassment and learning guitar from YouTube into the same bucket. It is a terrible threat model.
A better question is: what human system is being activated, and what does the environment reward next?
Status
Public metrics turn social approval into a scoreboard. Likes, followers, streaks, rankings and visible engagement make an invisible social process measurable.
Belonging
Communities provide identity and meaning. They can also make agreement a membership test. Once a belief becomes part of “us”, contradictory evidence can feel like an attack on the group rather than information about the world.
Fear and anger
Threats deserve attention. That is precisely why emotionally charged claims are so efficient at interrupting whatever you were doing five seconds earlier.
Certainty
Uncertainty is cognitively expensive. A simple explanation with a villain, a cause and a solution is emotionally satisfying even when reality is messier.
Think like a defender
Security people do not defend a network by telling packets to be more responsible. They change architecture, reduce exposure, inspect behaviour and assume that mistakes will happen.
Apply the same thinking to attention.
- Reduce unnecessary attack surface. Turn off notifications that exist primarily to pull you back into an app.
- Add friction before execution. Do not share emotionally charged claims immediately. Make verification a separate action.
- Inspect the payload. What exactly is the claim? What evidence would have to exist for it to be true?
- Identify privilege escalation. Is one claim asking you to accept a much larger identity, ideology or worldview?
- Watch for persistence. Repetition can make familiarity feel like truth even when nothing new has been demonstrated.
The goal is not to become immune to influence. That fantasy is another vulnerability. The goal is to make influence more visible.
A good mental firewall does not block every packet. It gives you enough telemetry to notice when something unusual is happening.