What Is Social Engineering?
Social engineering attacks the person, not the computer. Instead of breaking a system, the attacker manipulates someone with access into breaking it for them — revealing a password, approving a login, or running an attachment. Because it targets human psychology, it routinely walks straight past technical defenses that would stop any purely technical attack.
Why does social engineering work so well?#
Because it exploits reliable human tendencies rather than bugs. Attackers lean on a small set of psychological levers:
- Authority — posing as IT, a manager, or law enforcement.
- Urgency — “your account will be closed in one hour.”
- Trust — impersonating a colleague or a known brand.
- Fear and greed — threats of consequences, or the promise of reward.
None of these can be patched. A perfectly configured system still has people who can be hurried, frightened, or fooled — which is why phishing remains the most common entry point in real breaches.
What are the main techniques?#
| Technique | Channel | Hook |
|---|---|---|
| Phishing | Email / message | Fake link or attachment |
| Vishing | Phone | Urgent impersonation |
| Pretexting | Any | A fabricated backstory |
| Baiting | Physical / digital | A tempting lure |
| Tailgating | In person | Following through a secure door |
How do you actually defend against it?#
Defenses must be structural, not just “be careful”:
- Phishing-resistant MFA so a stolen password is not enough.
- Verification channels — confirm unusual requests through a second, known route.
- A blameless reporting culture so people flag mistakes fast instead of hiding them.
Social engineering is the human face of the attack surface. Continue at the Security Fundamentals hub.
Frequently asked questions#
What is social engineering?
Social engineering is manipulating people into taking actions or revealing information that undermine security — handing over a password, approving access, or running a file. It targets human psychology rather than software flaws, which is why the strongest technical controls can be bypassed by a convincing phone call.
What are common social engineering techniques?
Phishing (fraudulent messages), pretexting (an invented scenario), baiting (a tempting lure like a USB drive), tailgating (following someone through a door), and vishing (voice phishing by phone). All share a core recipe: impersonate a trusted party and apply pressure — urgency, authority, or fear.