Skip to content
Knowledge Hub/Article
Article

What Is Social Engineering? Attack Types and Defenses

Social engineering targets people, not technical flaws. We explain why it works, the techniques beyond phishing, deepfakes and the defenses that help.

Oğuzhan Gerçek··9 min read
What Is Social Engineering? Attack Types and Defenses

Short answer: Social engineering is the umbrella term for attacks that target people rather than technical flaws: the attacker wins a person's trust or applies pressure through authority and urgency, then persuades them to hand over information, grant access or send money. Its most common form is phishing; pretexting, baiting, quid pro quo, tailgating, vishing and impersonation with AI-generated voice or video belong to the same family. The main defenses are verifying payment and account changes through a second channel, keeping privileges to a minimum, using phishing-resistant MFA and making sure employees can report a suspicion without fear of punishment.

What is social engineering?

Under the definition in NIST's digital identity guidelines, SP 800-63-4, social engineering means deceiving a person into revealing sensitive information, gaining unauthorized access or committing fraud by winning that person's confidence and trust.

In Verizon's 2026 DBIR, the human element was present in 62% of breaches, and the Social Engineering pattern ranked third, at 16% of breaches. We explain where social engineering sits among cybersecurity threats in our cybersecurity article.

Why social engineering works

As Cisco puts it, social engineering is about the psychology of persuasion: the aim is to gain the target's trust so they lower their guard. The UK's National Cyber Security Centre (NCSC) lists five pressure tactics that criminals use:

  • Authority: Posing as an important person or organization, such as a bank, a doctor, a solicitor or a government department
  • Urgency: Threatening fines or other negative consequences
  • Emotion: Using threatening language, making false claims of support or teasing curiosity
  • Scarcity: Using the fear of missing out on a deal or opportunity to get a quick response
  • Current events: Exploiting news stories, big events or times of year such as tax season

According to MITRE, impersonation is typically preceded by reconnaissance, in which the attacker gathers identity and organizational information about the victim. The NCSC adds that information freely available on an organization's website and social media makes targeted messages more convincing.

Phishing and other techniques

In the ENISA Threat Landscape 2026, which analyzes incidents from 2025, phishing leads the social engineering techniques at 77.8%, followed by malicious spam (malspam) at 13%. We cover the types of phishing and how to defend against them in our phishing article; the other techniques are:

  • Pretexting: In Verizon's definition, the attacker builds a trusted relationship through concocted scenarios and tricks the user into an action that unknowingly compromises the organization, most often by voice but also by email or text message. In the 2026 DBIR, pretexting was the initial access vector in 6% of breaches, and it has become a more common way into ransomware and extortion attacks.
  • Baiting: As Cloudflare explains, the attacker dangles something desirable: a free software download containing malware, the promise of a payment or a professional favor. In its physical form, according to Cisco, USB sticks loaded with malware are left in the hope that someone will pick one up and plug it into a corporate computer.
  • Quid pro quo: ENISA lists it among social engineering attack vectors. Microsoft's guidance describes the same approach as an offer of assistance: the attacker offers to help, and the help ultimately requires the target to divulge personal information.
  • Tailgating: In the same guidance, an unauthorized person following someone with a pass into an office.
  • Vishing and callback phishing: In the FBI's definition, vishing targets people by voice. According to MITRE, some messages ask the victim to call a phone number, where they are directed to a malicious website, a malware download or the installation of remote management tools.
  • ClickFix: According to ENISA, this technique saw increasing use in 2025: the victim is asked to "fix" an issue, which ultimately leads to the execution of malicious code.

Account takeover through the help desk

The FBI and CISA's advisory AA23-320A of November 16, 2023, describes the methods of the Scattered Spider group. The group posed as company IT or help desk staff, using phone calls or SMS messages to obtain credentials from employees, and used social engineering to convince IT help desk personnel to reset passwords and MFA tokens. It sent repeated MFA prompts until employees pressed "Accept" (MFA fatigue), and convinced mobile carriers to transfer a target's phone number to a SIM card it controlled.

Following incidents that hit retailers, the NCSC advised organizations in May 2025 to review their help desk password reset processes, including how the help desk authenticates staff before a reset, especially staff with escalated privileges. The 2026 DBIR names the hard part: training IT help desks and customer support agents not to be helpful and supportive when someone is trying to manipulate them is not as simple as checking whether an email is external. We handle account reset processes in our identity management service.

Deepfakes: fraud with cloned voices and video

According to an FBI alert from December 2024, criminals use AI-generated audio to impersonate public figures or relatives in order to elicit payments, and generate videos for real-time video chats with supposed company executives, law enforcement or other authority figures. In the IC3's 2025 report, 22,364 complaints reported AI-related information, with adjusted losses above $893 million.

The FBI's advice is simple: if you have doubts about a caller, hang up, look up the organization's number yourself and call that number directly.

Social engineering in MITRE ATT&CK

  • T1566 Phishing: Part of the Initial Access tactic, with four sub-techniques, including Spearphishing Voice.
  • T1684.001 Impersonation: ATT&CK v19, released on April 28, 2026, revoked the Impersonation technique introduced in v14 as T1656 and replaced it with a sub-technique of Social Engineering: T1684.001. The attacker poses as an executive, a colleague or a third-party vendor; in many business email compromise (BEC) cases, this is how victims are deceived into sending money.
  • T1683.002 Generate Content: Audio-Visual Content: This technique, added in the same release, covers synthetic voice recordings and audio or video altered during live interactions.

The parent technique, T1684, describes steering users while minimizing technical indicators, and since v19 it sits under the Stealth tactic, which was split out of Defense Evasion. The mitigations listed for Impersonation are User Training (M1017) and Threat Intelligence Program (M1019). We explain how to map detection rules to ATT&CK in our SIEM and SOC article.

How to protect against social engineering

  • Verify through a second channel: The IC3 recommends using secondary channels or two-factor authentication to verify requests to change account information.
  • Least privilege: The privileges of the person who is deceived set the limit of what the attacker can reach. In NIST's definition, access privileges are restricted to the minimum needed for assigned tasks; see our IAM article for details.
  • Phishing-resistant MFA: According to CISA and the FBI, FIDO/WebAuthn or PKI-based MFA resists phishing and is not susceptible to MFA fatigue or SIM swapping. More in our MFA article.
  • Training and a reporting culture: According to the 2026 DBIR, email phishing simulations are now everywhere, but pretexting calls for business-oriented rules aligned with each potential target area. We cover exercises and a no-blame reporting culture in our phishing article.
  • Physical security: According to Cisco, help desk staff, receptionists and frequent travelers are more at risk from in-person attacks; it recommends controls such as visitor logs, escort requirements and background checks.
  • Testing: According to NIST SP 800-115, social engineering testing assesses the human element and user awareness of security. We explain the method in our penetration testing article; the service is on our security assessment page.

Here is how an example verification procedure could work for a request to change a supplier's bank details:

  1. Whatever channel the request arrives through, the change is not approved through that same channel.
  2. The purchasing team calls the supplier on the number already on file; the number in the request is not used.
  3. A second person, other than the one who made the call, approves the change (two-person rule).
  4. Who made the call, to which number and when, along with the outcome, is recorded.

This is an example; the roles will be different in your organization. We handle detection and response in our security operations service.

Frequently asked questions

What does social engineering mean? It means manipulating people, rather than exploiting a technical flaw, to obtain information, access or money. It plays on trust, authority and urgency.

What are the types of social engineering attacks? The main ones are phishing, pretexting, baiting, quid pro quo, tailgating, vishing, account takeover through the help desk and impersonation with AI-generated voice or video.

What is the difference between social engineering and phishing? Social engineering is the umbrella concept. Phishing is its most common form, carried out through electronic channels such as email and SMS.

How can you protect against social engineering attacks? The main defenses are verifying payment and account changes through a second channel, keeping privileges to a minimum, using phishing-resistant MFA, training employees and building a culture in which they can report suspicions without being blamed.

Sources