Ask a senior leader what actually keeps them up at night, and it is rarely the strategy deck. It is the quieter fear that somewhere in the organization, on an ordinary Tuesday, one of their people will make a single fast decision that becomes the headline. A wire transfer that never should have left the building. The hire that quietly unravels a team. One careless click.
That fear is well placed, and there is a number attached to it.
In early 2024, a finance employee at the engineering firm Arup joined a video call with the company’s CFO and several colleagues he recognized. They asked him to move money for a confidential transaction. He did, fifteen times, for a total of roughly 25 million dollars. Every person on that call was an AI-generated deepfake. What makes the case worth your attention is not the technology. It is that the employee had already sensed something was wrong. He was skeptical of the initial email, exactly the way his training taught him to be. Then he saw familiar faces on a screen, and his doubt dissolved. The fraud only surfaced later, when he followed up with headquarters through a separate channel.
His knowledge did its job. What overruled it was the wiring underneath.
The uncomfortable data
This is the part most leaders have not fully absorbed. Verizon’s 2025 breach report found that around 60 percent of breaches still involve a human element. More unsettling is a second finding buried in the same report. When the researchers examined whether security awareness training actually lowered the rate at which employees clicked malicious links, the click rate barely moved. Read that again if you fund a training budget. The thing most organizations rely on to protect them does almost nothing to the number it exists to change.
That should reframe the entire problem. If more knowledge were the answer, the best-trained companies would be the safest, and they are not.
Why knowledge keeps losing
The reason sits in how a decision actually gets made. Every choice runs through three parts of the mind. The cognitive, what you know. The affective, what you feel. The conative, how you instinctively act. We like to believe knowledge leads. Most of the time it arrives late, after instinct and feeling have already leaned on the wheel.
Artificial intelligence has made this far more dangerous by attacking the signal we trust most. A familiar voice or face used to be proof. It can now be manufactured from a few minutes of public video. The Arup employee did the human thing. He trusted the faces. The faces were the weapon.
This reaches well past anyone’s inbox. The same override shows up in the interview where a leader falls for a candidate in the first ten minutes and spends the rest of the hour justifying the choice. You will find it again in the boardroom, where a confident voice proposes a bet and the person with the quiet objection says nothing. Phishing is simply the version with a criminal on the other end. The mechanism is identical.
Friction has a bad reputation, and it earned most of it
So the leverage is not in making your people smarter. It is in shaping the environment they decide inside. That means friction, and most of what organizations install is the wrong kind.
Bad friction is the blanket approval nobody reads, the extra form that exists so someone can say a form was filled out, the process bolted onto every decision regardless of what is at stake. It adds steps without improving a single choice. It taxes the part of the mind that stores information, more to remember and more to route around, while leaving the parts where the decision is actually made completely untouched. It also teaches your sharpest people to build quiet workarounds, which strips out whatever protection it pretended to offer. Bad friction changes how long a decision takes and nothing about how good it is.
Good friction is a different instrument. It is a deliberate pause placed at the exact point where wiring tends to override knowledge, aimed at the layer that is actually weak. It does two things the blanket kind never manages. It protects, by building redundancy so that no single overridden human sinks the outcome. It also sharpens the decision, forcing the thinking into the open where assumptions get named and the quiet objector finally has room. The test is simple. Does the pause improve the decision or only delay it? Anything that only adds time is friction your people are right to resent, and eventually to route around.
Designing good friction with the three parts of the mind
This is where the three parts of the mind stop being a diagnosis and become a design tool. Good friction is built to engage the layer your team is weakest in for the decision in front of them.
Cognitive friction prompts recall. A required question at the moment of choice, a forcing function that makes someone retrieve what they already know. It is useful, and also the most overrated, because knowledge is rarely where the failure lives.
Affective friction protects the gut. In the Arup story, and in the near-miss I wrote about last week, it was a quiet internal signal that flagged the danger but then lost. Most organizations actively silence the gut signal by demanding evidence before anyone is allowed to hesitate. The better move is the opposite. Make “something about this feels wrong” a legitimate reason to pause, no spreadsheet required. The instinct that objects is often the only part of the mind reading the situation correctly, and it needs permission to speak.
Conative friction is the one almost no one designs, because almost no one measures it. The conative part is how your people instinctively take action, and it is the layer Kolbe was built to measure. It is the only validated instrument that does. Once you can see it, the design becomes obvious. A team wired to start fast and take the shot will lunge to the click, so creating a point of friction is a required beat before the leap. Give that same friction to a team wired to gather and analyze first, and you have only made a slow team slower. What they need is a forcing function that pushes them to move. Hand both teams the same policy and you get two different failures. This is precisely why generic protocols disappoint. They are built for a team that does not exist.
This is bigger than phishing
Once you see friction this way, it applies far beyond security. A few examples show how the same principle travels.
Let’s first take hiring. By the time a team is close to an offer, there is usually a clear favorite, and everyone can feel the momentum building toward yes. That momentum needs an override in action. When a candidate interviews well, so much that the entire room liked them, and that good feeling quietly becomes the decision. An interview mostly measures how well someone performs in an interview, which is a read on chemistry more than on fit. So the useful friction here has nothing to do with debating harder. It puts the conative layer on the table before the offer goes out. You look at how the person is actually wired to take action and match it against what the role demands once the good first impression wears off and the real work begins. A candidate can be capable, likable, and still completely mismatched to the way the job needs to get done. Measuring that fit is exactly what tools like Kolbe’s RightFit and the Predictive Index hiring assessments were built for, and it is the step most teams skip because the interview already made them feel certain. The friction replaces a gut impression with data on the one question the interview cannot answer.
Next, a major strategic bet carries the same trap wearing a different suit. A confident leader lays out the plan, everyone in the room nods, and optimism compounds to the point that any dissent feels almost like disloyalty. A pre-mortem breaks that spell. Before committing, the group imagines it’s a year later, and the bet failed, then works backward to explain what killed it. The shift sounds small but changes everything, because naming a risk is no longer an attack on the plan, it’s the assignment, the layer of assurance. This is a vital step because when assumptions nobody wanted to question out loud is permitted to surface, there is still time to do something about them.
Crisis decisions call for a different kind of resistance. Under real pressure, speed can feel like leadership, and the instinct is to move now and sort it out later. That instinct serves you well when a choice can be undone. The danger lives in the decisions that cannot be reversed, where moving fast only locks in the mistake. So the steadying rule is to match the length of the pause to how irreversible the decision is. A decision you can walk back next week can stay fast. The ones you will be living with for years earn a deliberate beat before commitment sets in, even when every nerve in the room is telling the team to hurry.
None of these are bureaucracy. Each is a small, targeted piece of resistance placed exactly where a particular kind of team tends to fumble, and each one improves the decision rather than only slowing it down.
Where Focus Needs to Stay
So the question is not whether your people are careful enough. Careful is a feeling, and the data is clear that feelings and training aren’t the only things that are tested under pressure. The more relevant question is whether you have designed the right friction into the decisions based on the humans involved. The decisions that can hurt you most need more careful consideration, where other decisions might need much less friction, so make sure the friction fits how your team is actually wired to act.
Most leaders cannot answer that, because they have never looked at their team’s wiring at all. They have studied what their people know. The decisions that keep them up at night are being made somewhere else entirely.
If closing that gap inside your own organization is worth a conversation, that is the work we do. Let’s set up a conversation https://meetwithalicia.com.