Social Engineering
Defensive view: social engineering. Authorised engagements only. We focus on what people fall for so awareness training and process controls can actually reduce risk.
Defender-first overview
EXAMPLE
# Social engineering - defender perspective > Lab and authorised engagements only. This page describes the patterns > attackers exploit so defenders can build awareness training, process > controls, and detection rules. Any live engagement requires signed > Rules of Engagement (RoE), scoped consent, and customer approval. No > real customer data appears in examples. ## What attackers actually try (and the human signals) - Urgency: 'I need this in five minutes' bypasses normal verification - Authority: posing as CEO, CFO, or a regulator - Familiarity: knowing one true fact (name of a project) and leveraging it - Reciprocity: offering small help to set up a bigger ask - Curiosity: a payload disguised as an internal HR doc - Pretexting: a manufactured story to justify the request ## Controls that defeat the human bypass - Out-of-band verification on payment changes (call the known number, not the one in the email) - Code phrase or shared secret for high-stakes verbal requests - 'Pause for 10 minutes' policy on any urgent financial change - Manager-of-manager approval for new vendor/payee setup - All wire transfer changes require two-person review - Internal reporting channel rewarded and visible (phish@yourco) - Vishing drills paired with regular phishing simulations ## Detection signals worth alerting on - Email impersonation: lookalike domains, display-name spoofing, reply-to mismatch - Conditional access anomalies: impossible travel, new device + new geo - Helpdesk ticket activity: password reset + MFA reset together - OAuth consent grants to new third-party apps with broad scopes - Mailbox forwarding rules created shortly after login ## Awareness training that works - Stop testing people on grammar mistakes; modern phishing is clean - Use realistic scenarios from your own industry (invoice, vendor change) - Reward reporting; do not punish clicks - Measure click-and-report rate together; click without report is the bad signal - Tabletop exercises for finance + IT + legal on a CEO-impersonation scenario ## Engagement reporting - Document what worked and what did not (which roles, which channels) - Pair findings with control recommendations and training topics - Anonymise individuals; trends are more useful than name-and-shame - Suggest measurable improvements (verification-bypass rate, time-to-detect)
Why it matters
Social engineering is the cheapest attack vector and the hardest to fix with technology alone. Process changes (out-of-band verification, two-person review on money movement) and a reporting culture outperform any one tool. A pen test that ignores this is incomplete.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Example
Example
# Engagements only with WRITTEN APPROVAL from a person with authority # to authorise testing of staff. Run debriefs without naming individuals; # focus on systemic fixes (training, MFA, sender authentication, link-rewriting).Try it Yourself »
Discussion
Loading…