Social engineering is the practice of manipulating people into performing actions or disclosing information that compromises security. It targets the human layer — the one layer that cannot be patched, updated, or replaced with a more secure version.

Every organisation, regardless of its technical security posture, is vulnerable to social engineering. The most sophisticated firewall in the world will not stop an employee from handing over their credentials to someone who sounds like IT support on the phone.

Why social engineering works

Social engineering is effective because it exploits predictable human behaviours rather than technical vulnerabilities. The principles it relies on are well-documented in psychology:

Authority. People are more likely to comply with requests that appear to come from someone in a position of power. An attacker posing as a senior manager, regulator, or law enforcement officer can pressure staff into acting without questioning the request.

Urgency. Time pressure short-circuits careful thinking. “I need this done in the next ten minutes or we lose the contract” forces the target to act before they have time to verify the request through proper channels.

Reciprocity. People feel obligated to return favours. An attacker who does something helpful — holding a door, offering technical assistance, buying a coffee — creates a sense of indebtedness that makes the target more likely to comply with a subsequent request.

Social proof. People take cues from others. “Everyone else in the department has already completed this step” makes the target feel that compliance is normal and expected.

Liking. People are more willing to help someone they find agreeable. Building rapport, finding common ground, and being friendly are all tools in the social engineer’s kit.

Scarcity. Limited availability creates urgency. “There are only two slots left for the security training” or “this offer expires today” pushes the target towards action.

These principles are not abstract — they are the building blocks of every pretext a social engineer constructs.

Common social engineering techniques

Social engineering encompasses a broad range of techniques, each suited to different contexts and objectives.

Pretexting

The attacker creates a fabricated scenario — a pretext — to engage the target and extract information or access. The pretext might involve posing as a colleague from another office, a vendor conducting a routine check, a bank verifying a transaction, or a recruiter with an urgent opportunity. The key is that the scenario gives the attacker a plausible reason to ask for what they want.

Impersonation

Closely related to pretexting, impersonation involves assuming a specific identity: a named individual, a role (IT support, building maintenance, auditor), or an affiliation (a specific company, government body, or service provider). Physical impersonation — wearing a uniform, carrying a clipboard, displaying a fake badge — is used for in-person social engineering.

Vishing (voice phishing)

Social engineering conducted over the phone. The attacker calls the target with a pretext designed to extract credentials, personal information, or actions such as transferring funds or disabling security controls. Caller ID spoofing makes the call appear to come from a trusted number.

Phishing

Email-based social engineering. Phishing emails attempt to trick the recipient into clicking a malicious link, opening an infected attachment, or entering credentials on a fake login page. Phishing ranges from mass-produced, generic campaigns to highly targeted spear-phishing aimed at specific individuals.

Tailgating

Gaining physical access by following an authorised person through a controlled door. The attacker relies on social norms — people hold doors for others, especially when the person behind them appears to belong. Variations include carrying large boxes (so someone holds the door), arriving at the same time as a group of employees, or entering through a smoking area.

Baiting

Leaving a physical device — a USB drive, a charging cable, a mobile phone — in a location where it is likely to be found by a target. The device is designed to compromise the system it is connected to. Despite widespread awareness of this technique, studies consistently show that a significant proportion of people will plug in a found USB device.

Open-source intelligence (OSINT)

While not a social engineering technique in itself, OSINT is the foundation of effective social engineering. Gathering information about the target — their role, responsibilities, colleagues, interests, and habits — allows the attacker to craft a more convincing pretext. The more the attacker knows, the more plausible the scenario.

How social engineering assessments work

A professional social engineering assessment is a controlled test of an organisation’s human-layer defences. It is designed to identify weaknesses in staff awareness, verification procedures, and the organisation’s ability to detect and respond to manipulation attempts.

Scoping. The client and the testing team agree on the objectives, techniques, and any constraints. For example, the assessment might focus specifically on vishing, or it might combine phone calls with in-person pretexting.

Target selection. Targets are selected based on their role and access. Reception staff, IT helpdesk, finance teams, and executive assistants are common targets because they handle sensitive requests regularly.

Pretext design. The testing team develops realistic pretexts based on OSINT and knowledge of the organisation. These are tailored to the targets and the objectives — the goal is to test whether staff follow established procedures, not to embarrass individuals.

Execution. The team carries out the agreed techniques, documenting every interaction: what was attempted, how the target responded, whether information or access was obtained, and whether the attempt was detected or reported.

Reporting. The report details each attempt, the outcome, and the organisational weaknesses it exposed. Findings focus on systemic issues (lack of verification procedures, inadequate training, no reporting mechanism) rather than individual failures.

Awareness training recommendations. Most social engineering assessments conclude with recommendations for improving staff awareness and organisational resilience. These might include targeted training for high-risk roles, introducing or strengthening verification procedures, and establishing a clear process for reporting suspicious interactions.

Building a human-layer defence

Social engineering cannot be eliminated — but its success rate can be significantly reduced through a combination of measures:

  • Regular awareness training that goes beyond annual slide decks. Effective training uses real-world examples, interactive scenarios, and is tailored to the specific threats the organisation faces.
  • Verification procedures for sensitive requests. Any request involving credentials, financial transactions, or access changes should require verification through an independent channel.
  • A reporting culture where staff feel safe reporting suspicious interactions without fear of blame. If people are punished for falling for a test, they will stop reporting real incidents.
  • Regular testing through social engineering assessments to measure resilience, identify weaknesses, and demonstrate improvement over time.

The human layer is the most flexible and adaptable element of any security programme. With the right training and procedures, it can also be one of the strongest.