When we think of hackers, we picture lines of code, dark rooms, and digital backdoors. But what if the most vulnerable part of your organisation isn’t your firewall—but your team?
Enter social engineering—the art of manipulating people to give up confidential information or perform actions that compromise security. It’s not new, but it’s getting smarter, subtler, and more dangerous.
What is Social Engineering?
Social engineering is a psychological attack. Rather than exploiting code, it exploits trust, curiosity, fear, or even kindness. The goal? To get someone to:
- Click a malicious link
- Reveal login credentials
- Authorise a bogus payment
- Grant access to restricted systems
In other words, it turns employees into unknowing accomplices.
Real-World Tactics
Some examples of social engineering techniques that are thriving right now:
- Phishing emails that mimic real services like Microsoft, DocuSign, or even your own CEO.
- Vishing (voice phishing) where attackers pose as IT support or bank reps over the phone.
- Tailgating, where someone follows an employee into a restricted area by pretending to be “new” or “locked out.”
- Pretexting, where an attacker builds a fake scenario (like pretending to be a supplier needing urgent access).
Why It’s on the Rise
With hybrid work, people are juggling more platforms, devices, and distractions. Combine that with AI-generated emails and voice clones, and it’s no wonder that even security-savvy employees are falling for these tactics.
In fact, according to recent reports:
- 98% of cyberattacks rely on social engineering in some form
- Human error is involved in 95% of security breaches
How Can We Protect Against It?
- Build a Culture of Curiosity
Encourage staff to question unexpected emails, calls, and requests, even if they appear to come from trusted sources. - Train Frequently (and Creatively!)
Make security training engaging and regular. Use simulations, gamified quizzes, and real-world examples. - Encourage Reporting, Not Shame
If someone clicks something suspicious, they should feel safe reporting it—not hiding it. - Limit Access and Privileges
Minimise the damage an attacker can do by ensuring employees only have access to what they need.
The most advanced security system in the world won’t stop an attacker who convinces your finance team to pay a fake invoice. That’s why human firewalls are just as important as digital ones.
Social engineering is a reminder that cybersecurity is a team sport—and every player counts.