A message arrives from a colleague you recognise, a caller says they are from your bank, and a senior manager appears to ask for an urgent payment. Each one feels ordinary, even reassuring, and each one could be entirely false. In a growing share of cyberattacks, the first breach is not a broken system or a clever piece of software. It is a person who, for a few seconds, believes what they have been told.
That is the heart of social engineering. Rather than forcing their way through technical defences, attackers persuade someone to open the door for them. Digital communication has given this old confidence trick a new scale, speed and reach.
What Is Social Engineering?
Social engineering is a broad description for harmful activity carried out through human interaction. At its centre is psychological manipulation: convincing a person to reveal sensitive information, hand over access, or move money. The attacker does not need to defeat a firewall if a helpful employee, customer or family member can be talked into doing the job instead.
To succeed, the attacker usually borrows a familiar identity. They may pose as a colleague, a bank, an authority figure, a friend or a relative. The target is therefore not a computer system but human judgement, which is why this kind of attack can feel closer to a confidence trick than to a conventional hack.
Why Social Engineering Matters for Business
For a business, the danger lies in how little needs to go wrong. An attacker does not have to deceive an entire workforce. One person who trusts the wrong message can be enough to expose customer information, financial accounts or internal systems, and that single opening can then lead to a much larger incident, including ransomware.
The scale of that human factor is underlined by Verizon’s 2026 Data Breach Investigations Report, which examined more than 22,000 confirmed breaches across 145 countries and found that 62 per cent involved a human element, with social engineering among the most common patterns. Technical controls remain essential, but they can be sidestepped when the person using them has been misled.
One Umbrella, Many Forms
Phishing is the best known form, yet it is only one branch of a much wider family. Deceptive emails may be sent in large numbers, hoping that a small proportion of recipients will respond, or they may be carefully tailored to one person using details gathered from public sources. Business email compromise takes a similar idea further, with messages that imitate executives or trusted suppliers in order to redirect payments or obtain sensitive information.
The same deception can arrive by telephone or text message, where a convincing voice or a short, urgent note can be harder to scrutinise than an email. In pretexting, the attacker invents a plausible story, such as a supposed security problem, and presents themselves as the person who can solve it. Baiting relies on temptation, whether a free download or an unattended storage device, while tailgating exploits ordinary courtesy, with an intruder following an authorised person into a restricted space without proper verification.
Why It Works: The Psychology
These tactics succeed because they work on instinct rather than on technology. Attackers borrow the appearance of a trusted brand or authority figure, then add fear, urgency, curiosity or an offer that seems too good to refuse. Under pressure, people often react before they have time to question what they are seeing, especially when a request arrives during a busy day, and a message that feels routine or familiar is precisely the kind a social engineer sets out to create.
Building Awareness Across the Organisation
Because people are the target, defences have to begin with people and with clear policy. Regular, practical training can help employees recognise suspicious messages, calls and requests. Equally important are simple verification habits, such as checking an unusual request through a trusted contact detail rather than replying directly, and confirming the identity of employees and visitors before granting access.
Access controls provide another layer of protection. Measures such as multi-factor authentication and restricted permissions do not stop a person from being deceived, but they can limit what an attacker can do with stolen credentials. Together, awareness and sensible controls reduce the chance that one mistake turns into a serious breach.
Why Protection Must Go Beyond Awareness
Even the best trained teams remain human. Staff juggle competing priorities, work under time pressure and handle a constant stream of messages, so warning signs can occasionally be missed. Awareness lowers risk, but it cannot remove human error altogether, and a single mistaken click should not be enough to bring down a whole organisation.
That is why security also needs to keep working after a mistake has been made. Frameworks such as the NIST Cybersecurity Framework set out a cycle of identifying risks, protecting critical systems, detecting threats, responding to incidents and supporting recovery. In practice, that means combining informed employees with monitoring, incident response and recovery planning, so that resilience does not depend on any one person being perfect.
