How Social Engineering Attacks Work and Why Technical Security Fails Against Them

The firewall was up. The antivirus was current. Multi-factor authentication had been rolled out company-wide two months prior.

The IT team had done everything right, technically speaking. And then a junior help desk analyst received a phone call from someone who sounded exhausted, a little frantic, and completely convincing, claiming to be a senior VP locked out of his account before a critical board call.

Forty minutes later, that caller had domain administrator privileges. No malware. No exploit. Just a conversation.

That story is not hypothetical. In one documented case tracked by Palo Alto Networks’ Unit 42, attackers gained full domain administrator access in under 40 minutes using only built-in tools and social pretexts, not a single line of malicious code. It is the kind of breach that does not show up cleanly in a vulnerability scan. It is also the kind of breach that is happening with increasing frequency, and most organizations still do not have a coherent answer for it.

Understanding why requires going beyond the surface-level narrative that employees are the weakest link. That framing is lazy, and in my experience, it is often wrong. The real problem is more structural, more psychological, and more difficult to solve than most security vendors are willing to admit.

What Social Engineering Actually Is (And What It Is Not)

Social engineering in cybersecurity refers to manipulating people into performing actions or divulging information that compromises security. The term gets thrown around loosely, but the mechanics behind it are rooted in decades of behavioural science, not just hacking culture.

It is not the same as phishing, though phishing is one of its most common expressions. It is not just clicking a bad link.

At its core, social engineering is about exploiting the cognitive shortcuts, emotional states, and social obligations that make human beings functional in society. Trust, urgency, authority, fear, curiosity, reciprocity, these are not bugs in human psychology. They are features. Attackers simply know how to weaponize them.

The reason this matters is that most organizational security strategies are built around the assumption that threats are technical. Firewalls stop traffic. Antivirus catches malware. Intrusion detection systems flag anomalies. None of those tools do much when an attacker is on the phone, convincing your IT team to reset a password.

The Anatomy of a Social Engineering Attack

How Attackers Build Their Approach

Before any contact is made with a target, serious social engineers do reconnaissance, often extensive reconnaissance. Open-source intelligence, known in the industry as OSINT, allows an attacker to gather names, organizational structures, internal vocabulary, vendor relationships, and personal details from LinkedIn, company websites, press releases, and even social media.

A well-prepared attacker calling your help desk already knows your ticketing system’s name, the name of the person they are impersonating, where that person is based, and the rough language your internal teams use. That level of preparation makes the call sound like any other internal request. The target is not being asked to do something suspicious. They are being asked to do their job.

The Role of Pretexting

Pretexting is the creation of a fabricated scenario designed to extract information or action from a target. It is not just lying. It is building a plausible world around the lie.

An attacker posing as a vendor auditor, a new hire, a regulatory compliance officer, or an IT security contractor is not just claiming a false identity. They are constructing a context that makes their requests feel normal.

The best pretexts do not raise alarm bells because they fit naturally into environments that are already busy, hierarchical, and trust-dependent.

Employees who question an apparent authority figure risk embarrassment. Employees who comply with a request that turns out to be fraudulent are simply doing their jobs in good faith. That dynamic is not a training failure. It is a design problem.

Phishing, Spear Phishing, and the Weaponization of Context

Phishing attacks remain one of the most documented entry points in cybersecurity breaches, but their character has changed significantly.

According to Mandiant’s M-Trends 2026 report, based on over 500,000 hours of incident response work, voice phishing has overtaken email as the primary social engineering vector. Email phishing dropped to just six percent of confirmed initial access methods in 2025, while voice phishing rose to eleven percent and reached twenty-three percent in cloud-related compromises.

Spear phishing, the highly targeted variant, is something else entirely. When an employee receives an email that references their current project, uses their manager’s name correctly, and arrives in a thread that looks consistent with their existing communications, they are not dealing with a generic phishing campaign.

They are dealing with someone who has done their homework. Phishing impersonation attacks, where attackers pose as emails from well-known brands or services to trick victims into clicking malicious links, now make up forty-nine percent of all socially engineered threats.

The distinction between bulk phishing and spear phishing matters because the defenses are different. Spam filters catch bulk campaigns. They do not catch a precisely crafted email sent to three people.

Vishing: The Attack Vector Most Companies Ignore

Vishing, voice phishing conducted over phone calls, is arguably the most underestimated social engineering vector in modern enterprise security. It is difficult to log comprehensively, it leaves little forensic trace, and it exploits the same trust cues that make phone-based business communication function.

Groups like ShinyHunters have used vishing campaigns to compromise credentials at SaaS vendors, harvest OAuth tokens and session cookies, then pivot into downstream customer environments for large-scale data theft. The method works because help desk processes are designed for speed and service. Skepticism is often interpreted as poor customer experience. That operational tension is exactly what attackers count on.

Why Technical Security Keeps Failing

The Fundamental Misalignment

Here is something that took me years to understand clearly: most cybersecurity tools are built to stop technical attacks, and social engineering is not a technical attack.

It is a human one. When an attacker manipulates a legitimate employee into performing a legitimate action, the system logs that action as authorized. Because it is, technically speaking.

MFA gets bypassed not because the cryptography is weak, but because an attacker calls an employee, claims there is an emergency, and convinces them to approve the authentication prompt they just received. This is not a failure of MFA as a technology. It is a failure of the assumption that technology alone can solve a human problem.

The Illusion of the Security Stack

Enterprise organizations spend considerable sums building what is often called a security stack, layered technical defenses including firewalls, endpoint detection and response, security information and event management, email gateways, and identity and access management systems. Each layer is meaningful. None of them operates on the social layer.

More than one-third of social engineering incidents in 2025 involved non-phishing techniques, including search engine optimization poisoning, fake system prompts, and help desk manipulation. In many environments, these tactics enabled attackers to slip through undetected, exfiltrate data, and cause significant operational harm.

The security stack assumes that threats announce themselves through technical signatures. Social engineering threats do not. They look like normal business activity because they are designed to.

MFA Bombing, Prompt Fatigue, and the Limits of Good Technology

Multi-factor authentication is a genuinely good control. It has prevented an enormous number of breaches. But MFA bombing, also called prompt bombing or MFA fatigue, is a technique that bypasses it entirely without breaking any cryptography.

The attack works by repeatedly sending authentication prompts to a target’s device until, out of frustration or confusion, the target approves one.

Prompt bombing attacks represented fourteen percent of social engineering incidents in 2024, and succeeded in more than twenty percent of attacks within the public sector in 2025. That is not a failure of the technology. That is an attacker understanding that humans, subjected to enough friction, will eventually relieve the friction themselves.

The Speed Problem

One of the most alarming developments in recent years is how fast attackers move once they have social access. The median hand-off time between initial access and transfer to a second attacker group has collapsed from over eight hours to twenty-two seconds. The time available to detect and respond to a social engineering breach has compressed dramatically.

Cybersecurity incidents in LevelBlue’s customer base nearly tripled in the first half of 2025, with the number of customers experiencing incidents jumping from six percent in the second half of 2024 to seventeen percent in 2025. That acceleration is not coincidental. It reflects a matured, industrialized attack ecosystem.

The AI Factor: How Artificial Intelligence Is Reshaping Social Attacks

Personalization at Scale

For years, one of the practical limits on social engineering was the time investment. Crafting a convincing pretext, researching a target, and executing a high-quality attack required human labour. Generative AI has largely eliminated that constraint.

AI-driven social engineering attacks now imitate how organizations communicate and operate, across email, documents, messaging apps, and identity systems. Attackers use AI to analyze how people make decisions and manipulate those cues to seek vulnerabilities.

By early 2025, more than eighty percent of phishing emails were using AI, and the European Union Agency for Cybersecurity forecasts that more than eighty percent of social engineering activity worldwide will be driven by AI-powered phishing. That shift changes the economics of the attack entirely.

Deepfake Voice and Video: The New Frontier

Deepfake technology has moved from novelty to an operational tool for sophisticated threat actors. Voice cloning, which can replicate a known individual’s voice from as little as a few minutes of audio, has been used in business email compromise scams and executive impersonation attacks with notable success.

The implications for corporate trust hierarchies are significant. When an employee can no longer rely on their ability to recognize their manager’s voice, the cognitive infrastructure of normal workplace communication becomes a liability.

ClickFix and the Rise of Fake System Prompts

Fake CAPTCHA social engineering attacks, especially ClickFix campaigns, jumped one thousand four hundred and fifty percent from the second half of 2024 to the first half of 2025. ClickFix is a technique that presents users with fake browser alerts, fraudulent software update prompts, or system error messages, then convinces them to paste malicious commands into their own systems.

ClickFix campaigns do not rely on a single delivery method. Instead, they exploit multiple entry points, including SEO poisoning, malvertising, and fraudulent browser alerts, to lure users into initiating the attack chain themselves. The user does the attacker’s work for them, believing they are resolving a legitimate technical issue.

The Real Costs: What Social Engineering Actually Does to Organizations

Financial Damage

A social engineering attack costs organizations an average of one hundred and thirty thousand dollars in stolen data or monetary theft, and when paired with other attack methods, that number can often skyrocket into the millions.

The United States lost sixteen point six billion dollars to social engineering attacks in 2024, a thirty-three percent increase from twelve point five billion the previous year. California alone recorded two point five four billion dollars in losses. These are not edge cases. They represent a consistent, escalating pattern of financial harm.

Reputational and Operational Damage

The financial figures, significant as they are, do not capture the full picture. Organizations that suffer a major social engineering breach typically face regulatory scrutiny, customer attrition, and internal trust erosion that lasts years beyond the incident itself. The operational disruption of a ransomware deployment triggered by a social attack, for example, can sideline entire business units for weeks.

The Nation-State Dimension

North Korean operatives have posed as remote tech workers to gain employment at major corporations and funnel money back to Pyongyang. Iranian-aligned groups such as Agent Serpens use fabricated institutional identities to distribute malware via spoofed emails and shared document platforms.

Social engineering has become a preferred initial access vector not just for cybercriminals, but for state-sponsored actors with sophisticated tradecraft and long operational timelines.

When adversaries with nation-state resources apply social engineering techniques, the sophistication level is categorically different from what most corporate security teams train employees to recognize.

What Actually Works: Defending Against the Human Attack Surface

The Shift to Human-Centric Security

The most significant change in how serious organizations approach social engineering defense is the abandonment of the “security awareness training as sufficient defense” model. Annual compliance training does not produce behaviour change at the moment of attack. People forget. People are busy. People make decisions under pressure that they would not make in a training scenario.

What produces behaviour change is repeated, realistic simulation, immediate feedback, and a security culture in which questioning unusual requests is socially acceptable rather than insuborditious. That last point matters more than most security teams acknowledge.

Verification Protocols That Actually Hold Up

The weakest point in most help desk and IT support workflows is identity verification. Asking someone for their employee ID number or their manager’s name is not verification. That information is often publicly available or easily obtained through the same reconnaissance that preceded the call.

Strong identity verification for sensitive actions requires out-of-band confirmation through a channel the employee controls independently, a callback to a number on file rather than one provided by the caller, manager approval through a separate system, or physical verification where operationally possible. These friction points feel inefficient. They are also exactly the kind of obstacles that social engineers cannot easily bypass.

Zero Trust Architecture as a Structural Defense

Zero trust security, the model that assumes no user, device, or network should be trusted by default regardless of position inside or outside the perimeter, offers structural resilience against social engineering in ways traditional perimeter security does not.

When every access request requires verification, when privilege escalation requires additional authentication, and when lateral movement is constrained by policy rather than assumed trust, the value of social access is significantly reduced. An attacker who convinces a help desk analyst to reset a password gains less when that password alone does not unlock sensitive systems.

Zero trust does not eliminate social engineering as a threat vector. It reduces the blast radius of a successful social attack, and that reduction is meaningful.

Threat Intelligence and Red Teaming

Organizations that invest in social engineering red team exercises, structured simulated attacks that test human responses rather than technical controls, consistently develop better organizational reflexes than those that rely on policy documents alone. The exercise surfaces process vulnerabilities that no audit would catch.

Unit 42 has tracked Muddled Libra, also known as Scattered Spider, as one of the most active social engineering groups, having infiltrated more than one hundred companies since 2022.

Understanding how specific threat actors operate, the pretexts they favour, the targets they select, and the timing they prefer allows organizations to build defenses calibrated to real-world attack patterns rather than theoretical ones.

Building a Security Culture That Reports, Not Just Reacts

The most underappreciated metric in social engineering defense is the reporting rate. When an employee recognizes something suspicious and reports it, the organization gains intelligence.

When they either fall for the attack or, equally common, simply dismiss the suspicious interaction without reporting, that intelligence is lost.

Creating an environment in which employees feel safe to report “I may have been manipulated” without fear of punishment is a cultural achievement, not a technical one. It requires explicit leadership messaging, confidential reporting channels, and a consistent organizational response that treats reported incidents as valuable data rather than evidence of individual failure.

The Uncomfortable Truth About Security Awareness Training

Security awareness training is a multi-billion-dollar industry. It is also, in its most common implementation, inadequate against the threat it purports to address.

Clicking a phishing simulation and reading the corrective page that follows is not the same as maintaining composure and skepticism when a convincing caller is applying social pressure in real time. The cognitive and emotional conditions of a real attack are not reproduced by an annual e-learning module.

Only half of employees are able to correctly define spear phishing, and sixty-two percent of organizations use a security awareness training program to reduce the likelihood of a successful phishing attack, yet breaches through social engineering continue to rise. The gap between training adoption and outcome improvement suggests that the content and delivery of training, not just its existence, determines its effectiveness.

What works better is continuous, scenario-based learning delivered close to the moment of relevance, supplemented by just-in-time coaching when employees encounter suspicious activity and supported by process controls that reduce the reliance on individual vigilance alone. Vigilance should be the last line of defense, not the first.

Looking Ahead: Social Engineering in a World of AI and Fractured Trust

The trajectory of social engineering as a threat category is toward greater personalization, lower cost per attack, faster execution, and increasingly blurred lines between what is real and what is fabricated.

Generative AI makes credible content trivially easy to produce. Deepfake audio and video make voice and identity verification increasingly unreliable. The attack surface is not shrinking.

The defense against social engineering is not a technology problem with a human component. It is a human problem that must be addressed with a combination of smarter technology, better processes, and a deep understanding of behavioural science.

Organizations that approach the problem primarily through vendor procurement, buying more security tools, will continue to face the same breaches through the same vectors. The organizations that are genuinely improving their posture are the ones treating human behaviour as an engineering challenge rather than a compliance checkbox.

That means investing in behavioural research to understand how their specific workforce makes decisions under pressure. It means redesigning workflows to reduce the reliance on individual judgment for high-stakes access decisions. It means taking the question of internal culture, of whether employees trust the security team enough to report honestly, as seriously as any technical control.

The attacker who called that help desk analyst before a critical board meeting did not need to know anything about firewalls.

They needed to know how people behave when they are trying to be helpful, when authority is invoked, when urgency is manufactured, and when the cost of saying no feels higher than the cost of saying yes. That knowledge is older than the internet, and it will remain relevant long after the current generation of security technology is obsolete.

The systems are not the problem. The systems have never been the problem.

What People Ask