Also known as: human hacking · pretexting
Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.
Social engineering works because the behaviours it exploits are the ones organisations otherwise want: employees who help colleagues, respond promptly to executives, and accommodate urgent requests. Training that frames these as failures tends to backfire; effective programmes focus on verification procedures rather than suspicion.
The most effective countermeasures are structural rather than educational — out-of-band verification for payment changes, phishing-resistant authentication, and approval workflows that no single person can bypass under pressure.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Business Email Compromise
Business email compromise (BEC) is a fraud in which an attacker impersonates or hijacks a trusted business email account to induce fraudulent payments or data disclosure, typically without deploying any malware.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.