Training Video | Social Engineering

Social engineering is the practice of manipulating a person into taking an action or revealing sensitive information, and it can arrive by phone, by email, or face to face.

Key concepts

• Attackers target people on purpose. Abusing someone's trust is often easier and cheaper than defeating a technical control.
• The usual levers are urgency, authority, fear, curiosity, and offers that seem unusually generous. Strong emotion is the warning sign.
• Pretexting means inventing a believable story. An attacker may pose as support staff, a courier, an auditor, or a vendor.
• Verify unusual requests using contact details you look up yourself. Never trust the phone number inside the message itself.
• Slowing down is a real defense, because these attacks depend on pressure and rushed decisions. Reporting early limits the damage, even when you already clicked.

Why it matters for your business

Everyone with an inbox, a phone, or a badge is part of your attack surface, whatever their job title. Teaching people to recognize manipulation, and making reporting easy and blameless, turns your staff into a detection layer instead of a gap. Building that awareness program and keeping leadership behind it is the kind of ongoing work a virtual CISO can carry for you.