Substitution is when a system does not just assist a person, but effectively replaces the person’s input, judgment, or decision-making. In security-sensitive workflows, that shift matters because the machine is no longer a helper at the edge of a task; it becomes the actor carrying out the task on the user’s behalf. With AI systems, substitution can happen quietly when a model drafts, edits, approves, or interprets content and the user accepts it without review.
In cyber security, substitution changes the trust boundary. It can make phishing harder to spot, blur authorship, and allow malicious content to be sent or approved with less scrutiny. Attackers may try to push users toward overreliance on automation, while defenders aim to keep humans in control through confirmation steps, clear labels, audit logs, and policy limits. The key question is whether the system is supporting the user or silently taking over the decision.