Social engineering
Psychological manipulation that leads a person to hand over information, access or money. It is the starting point of most successful cyberattacks.
Full definition
Social engineering is the psychological manipulation of people into taking actions or revealing confidential information that benefits the attacker. Instead of exploiting a technical flaw, it exploits human instincts such as urgency, authority, curiosity or fear.
Its channels go far beyond email: phone calls (vishing), text messages (smishing), QR codes (quishing), social media and instant messaging. According to CISA, more than 90 percent of successful cyberattacks start with a phishing email, the most common form of social engineering.
Effective defense is not about asking people to distrust everything. It is about training behavior with realistic simulations, measuring which instinct each person is vulnerable to, and validating with a retest that the behavior actually changed.
Related terms
Phishing
An attack that impersonates a trusted sender, such as a bank, a colleague or a vendor, to steal credentials, data or money, or install malware.
Pretexting
Social engineering built on an invented but plausible story: an audit, a vendor, a technician. The pretext justifies asking for data or access.
Vishing
Social engineering over a phone call. The attacker poses as tech support, a bank or a vendor to obtain access or payments in real time.
Smishing
Phishing via SMS or mobile messaging. It exploits trust in the phone and the absence of filters: the message arrives direct, short and with a link.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.