Not invented here

Category:

Not Enough Meaning

Definition:

The tendency to avoid using products, research, or knowledge that was not developed within one’s own organization or group.

Published on
September 4, 2024
Updated on
September 4, 2024
Not Enough Meaning

Learning Objectives

What you will learn:
Understand the concept of the Not invented here
Recognize the Impact of the Not invented here in cybersecurity
Strategies to mitigate Not invented here

Other Cognitive Biases

Author

Joshua Crumbaugh
Joshua Crumbaugh
Social Engineer

Subscribe to our newsletter

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

The Psychology behind the Not invented here:

The "Not Invented Here" (NIH) cognitive bias illustrates how organizational identity and pride can shape perceptions and decision-making processes within groups. Psychologically, this bias stems from a collective sense of belonging and loyalty to an organization, which can foster a protective attitude towards internally developed projects and innovations. When individuals perceive their organization's work as superior or more trustworthy than that of external sources, they may unconsciously dismiss external ideas or solutions, even if they hold significant merit. This bias is often reinforced by social dynamics within the organization, where conformity and groupthink may overshadow critical evaluation of external contributions.


The NIH bias can lead to an echo chamber effect, where the organization becomes insulated from fresh perspectives and innovative ideas that could enhance its effectiveness or competitiveness. This insularity not only stifles creativity but also creates a culture of resistance against change, as individuals may feel that adopting external innovations threatens their own contributions and professional identity. Consequently, organizations that fall prey to the NIH bias risk becoming stagnant, unable to adapt to evolving environments or leverage the wealth of knowledge and advancements available outside their walls. Recognizing and addressing this cognitive bias is essential for fostering a culture of collaboration and openness, which can ultimately drive greater innovation and success.

How To Differentiate the Not invented here from other cognitive biases?

The "Not Invented Here" bias is meaningfully distinct from other cognitive biases in its focus on organizational pride and identity, which can lead to a reluctance to adopt external innovations despite their potential benefits. Unlike general biases that may stem from personal preferences or emotional attachments, this bias is rooted in a collective mindset that prioritizes internal development over collaboration and external input. As a result, it can hinder progress and innovation within organizations by fostering an insular culture that undervalues valuable contributions from outside sources.

How does the Not invented here apply to Business Operations?

Scenario:

A cybersecurity firm, SecureTech, has developed its own proprietary threat detection software. The development team is highly proud of their creation, believing it to be the best solution in the market. However, a competitor recently launched a new software that utilizes advanced machine learning algorithms to detect threats more effectively. Despite evidence of the competitor's superior performance, the management team at SecureTech dismisses the new software, citing a preference for their in-house solution.


Application:

The management team conducts internal meetings to critique the competitor's software, highlighting its flaws and emphasizing their own product's strengths. They organize training sessions to further entrench employees' loyalty to the existing system, reinforcing the idea that any external solution would not align with their organizational values or culture. As a result, SecureTech continues to invest resources into enhancing their own software rather than exploring potentially game-changing external innovations.


Results:

Over the following months, SecureTech’s market share begins to decline as clients seek more effective cybersecurity solutions. The competitor's software gains traction in the industry, receiving accolades for its performance and ease of integration. Meanwhile, SecureTech’s continued focus on their internally developed software leads to missed opportunities for collaboration and partnerships that could have bolstered their offerings. Employee morale declines as frustration grows over the stagnation in innovation and the inability to adapt to market changes.


Conclusion:

This example illustrates the detrimental impact of the "Not Invented Here" bias on SecureTech, showcasing how organizational pride can cloud judgment and stifle innovation. By prioritizing internal solutions over viable external options, the firm risks falling behind in a rapidly evolving industry. To combat this bias, organizations must cultivate a culture of openness and collaboration, encouraging the evaluation and integration of external innovations that can enhance their products and services. Acknowledging and addressing the NIH bias is crucial for maintaining competitiveness and fostering a dynamic, innovative environment.


How do Hackers Exploit the Not invented here?

Scenario:

A social engineer, posing as an external consultant, approaches employees at a tech company, InnovateCorp, which has a strong "Not Invented Here" culture. The consultant praises the company’s internal projects and subtly suggests that external solutions are often inferior. By leveraging the employees' pride in their work, the social engineer crafts a narrative that aligns with their biases, making the employees more receptive to sharing sensitive information.


Application:

The social engineer conducts informal meetings and workshops, emphasizing InnovateCorp's superiority while downplaying the need for external input. They create a sense of camaraderie among employees, reinforcing the idea that reliance on external solutions could threaten the company's identity. During these interactions, the social engineer asks leading questions that encourage employees to divulge internal processes, security protocols, and proprietary information, all while appearing helpful and supportive.


Results:

As employees become increasingly trustful of the social engineer, they inadvertently share sensitive information about InnovateCorp’s software development practices and security measures. This information enables the social engineer to craft targeted phishing attacks and gain unauthorized access to the company’s systems. InnovateCorp faces a significant security breach, resulting in compromised data, financial losses, and damage to its reputation.


Conclusion:

This scenario illustrates how the "Not Invented Here" bias can be exploited by social engineers to manipulate employees into revealing sensitive information. By fostering an insular culture that prioritizes internal solutions, organizations may unintentionally create vulnerabilities that can be targeted by malicious actors. To mitigate this risk, companies must raise awareness about cognitive biases and train employees to recognize and report suspicious behavior, ultimately enhancing their security posture.


How To Minimize the effect of the Not invented here across your organization?

To defend against the "Not Invented Here" (NIH) cognitive bias, organizations must actively promote a culture that values external collaboration and innovation alongside internal development. One effective strategy is to implement a systematic approach to evaluating external solutions. This can involve establishing a dedicated team responsible for researching and assessing new technologies, products, or methodologies from outside the organization. By creating a formalized process for considering external contributions, management can help mitigate the insular mindset that often accompanies the NIH bias, ensuring that valuable insights and innovations are not overlooked.


Another crucial element in combating the NIH bias is fostering an environment that encourages open communication and diverse perspectives. Management should facilitate regular brainstorming sessions and workshops where employees are invited to share ideas, insights, and feedback on external developments relevant to the organization’s goals. By creating a safe space for discussion, organizations can help employees feel more comfortable acknowledging the potential benefits of adopting external solutions, thereby reducing the stigma associated with deviating from internally developed projects.


Training and awareness programs also play a vital role in defending against the NIH bias. Management should educate employees about cognitive biases, including the NIH bias, and how these biases can cloud judgment and decision-making. Through workshops and ongoing training, employees can learn to recognize their own biases and the potential consequences of adhering too rigidly to internal solutions. This knowledge can empower them to seek out and evaluate external alternatives critically, thereby enhancing the organization’s ability to adapt and innovate.


Lastly, organizations must lead by example, demonstrating a commitment to collaboration and openness. When management openly acknowledges and incorporates external innovations, it sets a powerful precedent that encourages employees to do the same. Celebrating successes that arise from external partnerships or the adoption of outside solutions can further reinforce the value of looking beyond the organization’s walls. By actively dismantling the NIH bias through these strategies, organizations can safeguard themselves against potential vulnerabilities—such as exploitation by malicious actors—while fostering a dynamic and forward-thinking operational environment.


Meet The Social Engineer

Joshua Crumbaugh

Joshua Crumbaugh
Recognizing the challenges and variation in applying psychology theory to real-world environments, I founded PhishFirewall, a security awareness and phishing training company built on these principles I’ve spent my career refining. We test and apply these concepts in diverse and practical ways to fit each organization’s unique needs.

I invite you to benchmark my company and discover how even slight changes in your approach can yield tremendous impacts on your organization’s security posture.

Hi, I’m Joshua Crumbaugh, and I’m proud to say that for over 20 years, I’ve been one of the leading Ethical Hackers in the United States. I’ve had the privilege of leading Red Teams for Fortune 500 companies, banks, governments, and large-scale enterprises, and and I routinely advises law enforcement agencies across the country and other industry leaders on emerging threats posed by human vulnerability.

The constant evolution of technology has advanced the tradecraft of exploiting people, but the good news is that people can be trained to become the most effective line of defense in any organization. Let’s work together to turn your people into your strongest line of defense.

What is PhishFirewall?

PhishFirewall is an emerging leader in people cybersecurity solutions designed to stop users from clicking on phish and empowers them to operate securely in the workplace.

AI autonomously delivers comprehensive awareness training and phishing simulations to optimize an organization's security posture and provides a one stop solution for industry specific compliance requirements. Unlike traditional tools, it provides zero campaign management, allowing administrators to strategically manage their priorities, with the added benefit of offering a streamlined, one-time setup with ongoing personalized training.
Key Benefits
Fully automate administrative management, reporting, and "just in time" communications.
Reduce organizational risk by 34% through customized training.
Increase employee engagement and performance by 42% without the punitive measures
“You set your people up in this system, and it just does it. It does it all."
– CISO, State Government
>80,000 Employees
“Once you see this in action, you can’t go back to the old way of training and testing.”
– CEO, Major Logistics Firm
>10,000 Employees
“This is security training 2.0, even the doctors do it!”
– CISO, Large Hospital
>30,000 Emoloyees

Key Features

Role-Based Phishing and Training

Tailor phishing simulations and training to each user’s role within the organization.

Customized Interaction and Testing

Adaptive training and testing based on individual performance and vulnerabilities for a personalized growth experience.

60-Second Training Modules

Quick, impactful training modules delivered in 60 seconds or less to fit seamlessly into your employees' day scaled at the frequency you want.

Complete Compliance Frameworks

Tailor phishing simulations and training to each user’s role within the organization.

Fast-Track Compliance

Accelerate your path to compliance with streamlined onboarding.

“Report a Phish” Button

Empower users to report suspicious emails with one click, improving overall security, speed of containment, and reduce the reach within the organization.

Multi-Language Delivery

Connect a global audience with training modules available in multiple languages.

Dual Coding Engagement

Enhance learning retention through dual coding techniques for better understanding and performance.

Extensive Training Library

Access a vast library of training materials that cover a wide range of security topics.

Customizable Training Modules

Create and deploy your own training modules to address specific needs within your organization.

Auto-Generated Reporting

Easily access automated reports that track progress and highlight areas for improvement.

User Report Cards

Provide individual feedback through user report cards, helping employees track their performance.

Organizational Leaderboards and Summaries

Foster healthy competition and track overall progress with organizational leaderboards and performance summaries.

Interactive Charts and Graphs

View trend analysis and performance distributions in real-time through dynamic, easy-to-read charts and tables.

Best-in-Class Administrative Dashboards

Manage your training programs effortlessly with intuitive, best-in-class dashboards designed for ease of use.

One-Day Setup

Get up and running quickly with a setup process that takes just a few hours.

Scalability

Effortlessly onboard new users and can be scaled to an organization of any size.

More In the Pipeline

We are always striving to innovate, and create the features that solve your problems!
Exclusive Offer!

Get Free Security Awareness Posters Today!

Secure your office with this months free security awareness posters!
PosterPosterPoster