What is social engineering?

Social engineering is the use of influence to persuade someone to act in a way that may or may not serve their interests. It relies on emotions, curiosity and our tendency to trust other people. Its core techniques include persuasion, manipulation and the deliberate escalation of fear. In the hands of cybercriminals, social engineering can be a highly effective weapon.

Social engineering is part of everyday life

Even when we do not notice it, social engineering surrounds us every day. People use influence and manipulation in face-to-face conversations, phone calls, social media and advertising.

Did you know that we can decide whether to buy a product within 90 seconds of seeing it? Research also suggests that the logo, color and packaging can strongly influence our choice. Product designers and marketing specialists understand this and use it to increase sales.

Sales staff recommend products, clothes and accessories that seem perfectly suited to us—even when they were not part of our original plans. Shopping centers use carefully selected music and pleasant scents, while stores arrange products to encourage additional purchases. A bartender who puts a banknote in the tip jar or a waiter who adds a small gift to the bill may also be encouraging generosity. These are everyday examples of influence and manipulation.

Good versus evil

Social engineering is neither good nor bad in itself. It is a tool with many possible uses, and carefully designed interventions can benefit individuals or society as a whole.

For example, one company fitted park bins with motion sensors and speakers that played a cartoon-style falling sound whenever someone threw something away. The park quickly became cleaner, without the city having to pay for additional cleaning. In another example, ordinary stairs were redesigned to look and sound like piano keys, encouraging people to use them instead of the escalator. Both ideas changed behavior through positive, playful cues.

There is also a darker side. People and organized groups use social engineering to exploit others. Hackers manipulate decisions, clicks, attachment openings, logins to fake websites and software installations in order to steal money or data, demand a ransom, obtain access or permissions, spy on victims, misuse devices or identities, or disrupt companies and institutions.

The most common tool used by cybercriminals is phishing, together with variants such as spear phishing, BEC, CEO fraud, smishing and social-media scams. Attackers exploit emotions and continuously refine their methods around human weaknesses.

The weakest link in corporate cybersecurity

People are the weakest link in many corporate security chains. As many as nine out of ten cyberattacks target humans. Bypassing technical controls to reach a network and steal valuable information can take a hacker considerable time. Manipulating an employee to obtain the same information may take only minutes.

A cybercriminal will manipulate you into taking a specific action—share credentials, transfer money to a fraudulent account, run a file or click a link that exploits an application vulnerability, including a zero-day vulnerability. To achieve this, the attacker may exploit a sense of duty, fear, curiosity, sympathy or the desire to help. They try to prevent a careful review of the message’s technical details—such as the sender’s domain and the real link address—or its wider context, such as why an online store is contacting a corporate address. The manipulation is designed to be subtle enough that the victim may not realize what happened until it is too late.

How to strengthen your company against hacker attacks

Social-engineering attacks are constantly evolving and exploit gaps in employees’ security awareness. To protect the organization, strengthen both people’s skills and the processes around them. The sooner you act and choose effective measures, the sooner you reduce the risk.

Our mission is to promote a security culture and improve employees’ security awareness.

Practical Anti-Phishing Training is our proprietary program. It teaches safer behavior through controlled attack simulations that use the same techniques as real attackers. Employees can practice recognizing manipulation and responding correctly in a safe environment. By varying the social-engineering techniques and scenarios, the program builds vigilance, improves awareness and strengthens security at work and at home.