Human
What social engineering is
Short answer
Social engineering is obtaining access, data or money through a person rather than through technology. An attack has four steps: gathering information, building trust, creating a reason for urgency and asking for a specific action. You cannot defend against it technically — you can learn to recognise the structure and stop at the third step.
Why it matters
A password is hard to guess but easy to ask for. That is why most incidents involve no hacking at all: there is an employee who carried out a plausible request. Understanding the mechanics matters both at home and at work: the same four steps appear in a call to an elderly parent and in an email to the finance team.
A real scenario
How it looks from the inside
A “new employee of a contractor” calls: they know your manager's name, the project title and an internal term. They ask you to confirm access to a folder — “otherwise we miss the deadline”. Knowing those details is the result of step one: they were collected from open sources and past leaks.
Signs
- The caller knows details but cannot confirm their role.
- A request to bypass the usual procedure for the sake of speed.
- An appeal to authority: a manager, the security team, an inspector.
- A request to keep the conversation confidential.
- Contact arrives through a channel nobody normally uses.
What to do
- Confirm the identity through an independent channel — find the contact yourself.
- Follow the procedure precisely when you are being rushed.
- Do not widen access “temporarily”.
- Report suspicious contact even if nothing happened.
- Discuss such cases with the team: it is the best training there is.
Expert view
Companies spend years buying technical defences and barely train their people. Yet the most expensive incidents that reached my desk began with one polite conversation and one request carried out from a wish to help.
Frequently asked questions
Is social engineering only about IT?
No. The same principle works in phone fraud, in negotiations and in everyday schemes.
Is training employees once enough?
A single briefing barely changes behaviour. What works is short, regular practice with breakdowns of real attempts.
Should mistakes be punished?
Punishment makes employees silent and incidents late. A culture of early reporting is far more useful.