A new paper by Reza Fahmi and Prima Aswirna (UIN Imam Bonjol Padang) cites the Cybersecurity Psychology Framework three times and tests its thesis on 320 employees over 12 weeks. When authority, urgency and fear arrive together, clicks on a phishing link go from about 1 in 12 to almost 1 in 2. We have proposed a joint validation.
## What happened
The Cybersecurity Psychology Framework (CPF3) is our catalogue of 100 indicators that read the psychological weak points of an organisation before they turn into incidents. A new paper, *Hacking the Mind: The Psychology Behind Cybersecurity* by Reza Fahmi and Prima Aswirna (Universitas Islam Negeri Imam Bonjol Padang, Indonesia), uses it as part of its theoretical grounding. Nobody asked them to: they found the framework and built on it, and their abstract adopts its wording, *pre-cognitive vulnerabilities*.
## What they measured
320 employees in finance, healthcare and technology each received 12 simulated phishing emails over 12 weeks. The emails came in four kinds: neutral, with executive authority, with urgency and fear, and with all of these together.
```chart
{"title": "How often employees clicked the phishing link", "series": ["Clicked the link"], "unit": "%", "max": 60, "rows": [["Neutral email", 8.4], ["Authority", 22.8], ["Urgency and fear", 34.2], ["All levers together", 48.1]], "note": "Fahmi and Aswirna (2026): 320 employees, 12 simulated emails each over 12 weeks."}
```
The jump is the point. Each pressure on its own raises the click rate; together they push it to almost one person in two. This is what CPF3 calls a convergent state (its tenth category): indicators that do not add up linearly when they occur at the same time. The study also found that where mistakes are punished, people report them about eight times later, which maps onto the framework's stress and group-dynamics categories.
## What comes next
We have written to the authors proposing a joint validation: score the CPF3 indicators on their participants and check, condition by condition and sector by sector, whether the scores predict who clicks, who enters a password and who stays silent. If they do, it is field evidence for the framework; where they do not, it shows what the framework is missing.
## Technical detail
Engagement rate (link clicked): 8.4% neutral, 22.8% authority, 34.2% urgency and fear, 48.1% compound. Credential submission: 2.1%, 8.5%, 14.6%, 28.3%. Mean reporting latency: 14.2, 32.6, 68.4 and 112.8 minutes. The four conditions map onto CPF3 categories 1 (authority), 2 and 4 (temporal, affective) and 10 (critical convergent states); cognitive load and security fatigue map onto categories 5 and 7.
This update is not available.