Home / Knowledge hub / Social engineering
Knowledge hub
Social engineering
Manipulating people, not software, into giving up access or information.
What it means
Social engineering is the use of persuasion, pressure or deception to get a person to do something that helps an attacker: share a password, approve a login prompt, change a bank detail, open a file or hold a door. The target is the human, not the software.
It works because it borrows trust. The message looks like it comes from a boss, a supplier or the help desk, and it creates a reason to act quickly. Careful, intelligent people are caught every day, usually when they are busy.
Why it matters
Many serious breaches begin with a conversation rather than a flaw in code. A stolen password gets past every technical control, because it is a valid sign-in. The fallout is the same as any other intrusion: data taken, money moved, systems locked.
Fraud that relies on persuasion is also expensive in its own right. In business email compromise, a convincing message from a fake executive or supplier can redirect a payment. No malware is needed, and no technical alert fires. The control that fails is trust, so the control that helps is process.
How it shows up
Common forms are phishing by email, voice calls pretending to be IT support, text messages, fake pages that copy a login screen, and impersonation of staff in chat. Attackers may also prompt a user repeatedly for approval, as in MFA fatigue, until one is accepted.
Training helps but is not enough alone. Add controls that do not depend on people noticing: phishing-resistant sign-in such as passkeys, a second person to approve payment changes, a call-back to a known number, and an easy way to report a suspicious message without fear of blame. Test it with a social engineering test.
Questions people ask
Social engineering, answered
Is social engineering the same as phishing?
Phishing is one kind of social engineering, carried out through messages. Social engineering also includes phone calls, in-person visits, fake support requests and manipulation inside chat tools.
The common thread is deceiving a person.
Why do smart people fall for it?
Attacks are designed to exploit habits, not ignorance: urgency, authority, curiosity and the wish to be helpful. Anyone is vulnerable when tired or rushed.
Treat it as a design problem for processes, not a failing of individuals.
Does multi-factor authentication stop it?
It helps a great deal, but not against everything. Attackers can trick users into approving prompts or reading out codes, or relay a login in real time.
Phishing-resistant methods such as passkeys are stronger.
How do we train staff well?
Keep it short, specific and regular. Use examples from your own tools, explain what to do when something looks wrong, and make reporting easy and rewarded.
Avoid punishing people who click, as they will stop telling you.
Can application testing find social engineering risks?
Partly. Testing can show where your app helps an attacker, for example account recovery that a support agent can be talked into, or error messages that reveal valid users.
The human side needs its own exercise.
Sources
Where this comes from
Related
Terms that sit next to this one
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Business email compromise
Fraud using a hacked or faked work email to redirect payments or data.
Social engineering test
Checking whether people can be talked into handing over access or information.
MFA fatigue
Spamming approval prompts until a tired user taps accept.
SIM swap
Taking over a phone number so text-message codes reach the attacker instead.
What does your recovery flow give away?
Account recovery and password reset flows are a common target for persuasion. We test those flows in your web app and report what we actually exploited, with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.