Default trust bias is the human tendency to accept a request, message, or voice as legitimate when it feels familiar, urgent, or authoritative. In cybersecurity, attackers exploit this shortcut with phishing, vishing, impersonation, and other social-engineering tactics that imitate trusted people or routine business pressure.
This bias matters because security failures often happen before any technical control is triggered: a user clicks, approves a transfer, resets a password, or shares a code because the request seems normal. Defenders reduce the risk by separating recognition from authorization, using out-of-band verification, requiring call-backs or approvals through independent channels, and designing workflows that do not rely on instinct alone. The goal is to make familiarity a signal to verify, not a reason to trust.