An air traffic controller monitoring a busy airspace faces an inevitable challenge: the chance of missing the critical aircraft amid high demand. This phenomenon, known as vigilance decrement, has been a focus in aviation for over seventy years, leading to sophisticated design strategies to address it. Now, the growing reliance on AI is shifting knowledge work into similar high-pressure roles, where individuals juggle multiple tasks at once—emails, chat messages, and automated processes—all while being hailed for their efficiency. Yet, the vigilance decrement isn’t forgiving; it arises regardless of how busy one is.
How Aviation Tackled Vigilance Challenges
Rather than asking air traffic controllers to concentrate harder, aviation embraced technology to mitigate human error. The industry developed automated systems capable of monitoring air traffic independently, thereby prioritizing machine intelligence over human judgement in critical moments. A tragic event in 2002 over Überlingen underscored this need when an overloaded controller mistakenly issued conflicting commands to a passenger jet; the result was a deadly collision between two aircraft, claiming 71 lives. The aviation industry responded with a clear guideline: when machine recommendations conflict with human command, the machine prevails. It's worth emphasizing that these machines, though not intelligent in a cognitive sense, offer reliability without subjective judgement.
A Shift in Security Approach
Conversely, the security sector has largely relied on human vigilance as the last line of defense against threats for the past three decades. This strategy has grown increasingly precarious with the advent of AI, which has significantly lowered the telltale signs of malicious activity. A study by cybersecurity experts Bruce Schneier and Fredrik Heiding revealed that AI could drastically reduce the cost of phishing campaigns by over 95%, while achieving similar success rates as seasoned human teams. The previous indicators that trained individuals to spot threats are becoming obsolete.
Moreover, the current landscape of cybersecurity mirrors the overloaded air traffic controller's role. The sheer volume of communication and transactions can overwhelm workers, leaving them vulnerable to hidden attacks masked within legitimate requests. Unlike aviation, where a gathering plane visibly presents a threat, fraudulent activities can be camouflaged in benign communication, making them harder to detect.
Focus on High-Risk Threats
Recognizing that not all threats are equal, a strategy needs to emerge that emphasizes the most dangerous actors. Data indicates that a small percentage of attacks, such as business email compromises (BECs), result in significant financial damage. For instance, the FBI reported over 21,000 BEC complaints in 2024, with these incidents contributing to nearly $2.8 billion in losses. Such attacks may be less frequent but have catastrophic outcomes, often leading to irreversible financial actions.
This aligns with aviation’s lesson: prioritize tasks where the stakes are extraordinarily high. Robust mechanisms should be implemented to monitor actions that could lead to severe repercussions. For example, a mandatory callback to a verified number for changes to banking information, dual approval for wire transfers, and automated stop-limits on larger transactions could help mitigate risks. Unlike previous systems dependent on recognizing threats, these controls need to be activated based on specific actions, safeguarding against potential pitfalls.
However, tackling the intricacies of fraud that already appear legitimate remains challenging. A request masquerading as a normal vendor interaction can have all the correct details, making it even trickier to catch. Here, the nuanced use of contextual judgement versus the mechanical response that aviation systems successfully execute becomes apparent; our security systems cannot merely react based on sound parameters.
Rethinking Trust in Systems
For aviation, the protocol meant trusting a machine that emits clear, unambiguous directives. However, in security, the intelligent systems that can analyze context and intent require trust to be granted by users before they can override human input; currently, many systems lack that essential trustworthiness. Trust cannot be gained from a system that frequently disrupts operations or yields erroneous results.
The fallout from security failures is quieter than aviation disasters, but it remains profound, often resulting in lost funds or compromised identities. Thus, the industry must shift from expecting humans to remain vigilant—something aviation learned years ago was unrealistic—and instead implement automatic safeguards around high-risk moments.
In essence, the focus should be on establishing controls that act independently of human oversight, similar to aviation’s strategy, while also testing and refining the smart technologies designed to assist human decision-making. The critical question isn’t whether individuals are vigilant; rather, it’s whether effective mechanisms exist to block potentially hazardous actions when human attention may falter.
