Cybersecurity glossary
What is Social Engineering?
Learn what social engineering is, how attackers exploit trust, urgency, and helpfulness across email, phone, and in-person channels, and which process controls reduce human-targeted attacks.
Definition
Social engineering is the practice of manipulating people into taking unsafe actions or revealing sensitive information by exploiting trust, authority, fear, helpfulness, or routine—rather than by exploiting a software vulnerability as the primary step.
Why people are in the attack path on purpose
Software has patches. Humans have jobs. Social engineering aims at the second system: the receptionist who wants to be helpful, the controller who does not want to block a CEO, the engineer who does not want to stall a launch. The attacker studies how the organization is supposed to behave, then occupies a legitimate-looking request.
This is not a claim that users are “the weakest link” as a personality flaw. It is a design observation. If a process allows one persuaded person to reset MFA, change a beneficiary, or admit a visitor, then persuasion is an access control bypass. Criminals and some intrusion sets prefer that bypass because it does not require a novel exploit.
Social engineering therefore belongs in the same threat model as injection and stolen keys. It has techniques, playbooks, and mitigations. Treating it as a training-only problem leaves the exception paths wide open.
The influence levers attackers reuse
Authority
A supposed executive, regulator, or IT owner makes refusal feel like insubordination or policy violation.
Urgency and scarcity
A deadline, a limited window, or ‘this offer expires’ crowds out the extra minute a callback would take.
Helpfulness
Support, reception, and assistants are evaluated on solving other people’s problems—exactly the instinct being used.
Fear and confidentiality
Threats of account lockout, legal trouble, or ‘do not tell anyone’ isolate the target from a second opinion.
These levers appear in email, on calls, at the door, and inside chat. The channel is interchangeable. The request that must not use the normal path is the invariant.
A typical social-engineering arc
Reconnaissance
Collect names, tools, vendors, and org habits from websites, social media, breaches, and prior conversations.
Target selection
Choose someone who can approve money, reset identity, hold a door, or influence a more valuable person.
Pretext and channel
Pick a story and a medium—mail, SMS, voice, QR, in person—that the target already uses for similar tasks.
Engagement
Establish trust with true fragments, then ask for the unsafe action as if it were routine work.
Action and exploitation
Receive the wire, session, badge, or secret and convert it before the victim compares notes with a colleague.
Cover and repeat
Silence the mailbox, pressure the victim not to report, or reuse the relationship against the next person.
Mapping techniques without mixing them up
| Technique | Primary trick | Typical ask |
|---|---|---|
| Phishing / spear phishing | Deceptive message and destination | Sign in, open a file, grant an app |
| Smishing / quishing | Mobile or QR-hidden URL | Tap or scan, then authenticate |
| Vishing / pretexting | Live identity performance | Read a code, install remote access, pay |
| BEC | Business-process impersonation | Change payee or send a transfer |
| Shoulder surfing / tailgating | Physical proximity | Observe a secret or enter a space |
Controls that work when persuasion is the exploit
Awareness is necessary. It is not a control that fails closed.
- Bind high-impact actions to process: dual control for payments, known-good callbacks for identity, badges issued only from HR records.
- Give staff permission—and time metrics that allow it—to slow down under authority and urgency.
- Deploy phishing-resistant MFA so a convinced user still cannot complete a lookalike login.
- Least-privilege everything a persuaded person could touch: mailbox rules, vendor bank fields, production roles, visitor systems.
- Make reporting cheaper than silence; first reports of a new pretext should page the same way a malware alert does.
- Train the jobs that are targeted for helpfulness—help desk, reception, finance ops, executive assistants—with scene-based practice, not only click tests.
- Limit public reconnaissance value: org charts, tool stacks, and ‘out of office’ details are raw material for the next call.
- Include physical social engineering in the threat model: doors, QR posters, and screens visible in cafés.
Measuring the right outcome
Click rates in simulations are a weak proxy. Better questions: how long from first report to session revoke? How many payee changes skipped dual control? How many MFA resets used the on-file callback? Social engineering defense is operational, not theatrical.
The practical takeaway
Social engineering exploits how organizations get work done—trust, speed, and helpfulness—rather than how a parser handles input. Phishing, vishing, BEC, and physical impersonation are delivery details.
Design the business so a perfect story is still insufficient. Verify on a channel you already trust, split duties on irreversible actions, and treat a persuaded human as a predictable failure mode you can engineer around—not as a moral surprise.
Related security terms
Phishing
The most common digital delivery of social engineering: a deceptive message plus a hostile destination.
Pretexting
The invented identity and scenario that makes the unsafe request feel like ordinary work.
Business Email Compromise (BEC)
Social engineering aimed at payment and payroll authority instead of a software exploit.
Spear Phishing
Researched, person-specific lures that apply social engineering to a chosen mailbox.
Vishing
Live-call social engineering that can adapt when the target hesitates.
Frequently asked questions
What is social engineering in simple terms?
It is tricking a person instead of breaking a program. The attacker convinces someone to click, pay, reset, hold a door, or share a secret because the request seems legitimate.
Is phishing the same as social engineering?
Phishing is one delivery method. Social engineering also includes vishing, smishing, quishing, pretexting, tailgating, and fake help-desk visits. Phishing sits inside the larger category.
Why do technically strong organizations still get hit?
Controls fail open when a human is allowed to override them under pressure. Attackers target the exception path: emergency wires, MFA resets, visitor badges, and ‘temporary’ access.
Does security awareness training stop social engineering?
Training helps people recognize patterns and report faster. It does not replace dual control, callbacks, least privilege, or phishing-resistant authentication.
Is social engineering only remote?
No. Physical techniques include tailgating, shoulder surfing, fake maintenance visits, and planted USB or QR codes. Digital and physical pretexts often combine.
What should a person do in the moment?
Slow down, switch channels, and verify using contact details you already had. Do not prove the story on the attacker’s phone call, chat, or email thread.
Are red-team social-engineering tests the same as crime?
Authorized tests follow rules of engagement and consent. The techniques overlap; the difference is permission, scope, and the goal of improving defenses rather than stealing.
References
Explore authoritative guidance and frameworks related to social engineering.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.