Organisations spend heavily on security technology: firewalls, endpoint detection, email filtering, identity platforms. These investments matter, and they stop an enormous volume of attacks every day. Yet many of the most damaging breaches of recent years began not with a technical exploit but with a conversation: a phone call to a service desk, a convincing email to a finance team, a message that appeared to come from a senior executive.
Social engineering works because it targets people rather than systems. It exploits trust, helpfulness, urgency and authority, qualities that make organisations function well day to day. Technology can reduce the volume of attempts that reach people, but it cannot remove the fundamental exposure. At some point, a person will be asked to make a judgement, and the attacker's goal is to make the wrong judgement feel reasonable.
This article examines how modern social engineering works, why traditional awareness training so often fails to stop it, and what an effective human defence looks like.
How modern social engineering works
Social engineering has evolved considerably from the poorly spelled phishing emails that many awareness programmes still use as examples. Today's attacks are researched, targeted and often multi-stage.
Business email compromise
Attackers impersonate executives, suppliers or partners to request payments, change bank details or obtain sensitive information. Messages are often sent from compromised legitimate accounts or closely similar domains, and are timed to coincide with real events: a known acquisition, a quarter-end payment run, an executive travelling abroad.
Service desk impersonation
Attackers call IT service desks posing as employees who have lost access to their accounts, requesting password resets or multi-factor authentication changes. Armed with details gathered from social media and previous breaches, they can be highly convincing. Several high-profile intrusions in recent years began exactly this way.
MFA fatigue and real-time phishing
Where organisations use push-based multi-factor authentication, attackers who have obtained a password may send repeated approval requests until a frustrated user accepts one. Real-time phishing kits proxy the genuine login page and capture both credentials and session tokens as the victim signs in.
Voice and video impersonation
Advances in generative AI have made it possible to clone voices from short audio samples and to produce convincing synthetic video. Attackers have used these techniques to impersonate executives on calls and authorise fraudulent transfers. This is no longer a theoretical risk.
Pretexting and physical intrusion
Some attacks still take place in person: an individual posing as a contractor, a delivery driver or a new employee, relying on politeness and the reluctance of staff to challenge someone who appears to belong.
Why traditional awareness training fails
Most organisations run some form of security awareness training. Much of it follows a familiar pattern: an annual e-learning module, a quiz, and perhaps a periodic simulated phishing email. Completion rates are reported to the board, and the programme is considered done.
This approach has well-known weaknesses:
- It is infrequent. An annual module competes with thousands of other pieces of information and is largely forgotten within weeks.
- It is generic. The finance team, the service desk and the executive assistant face very different attacks, yet often receive identical content.
- It focuses on recognition rather than response. Spotting a suspicious email is useful, but knowing exactly what to do, and feeling confident doing it, matters more.
- It measures the wrong things. Completion rates show that training was delivered, not that behaviour changed.
- It can create a blame culture. Programmes that publicly shame people who click on simulations teach employees to hide mistakes rather than report them.
The goal of awareness training is not a workforce that never clicks. It is a workforce that reports quickly, verifies instinctively and is never embarrassed to ask.
What an effective human defence looks like
A strong human defence is built from several elements working together: role-based training, realistic practice, verification procedures, a reporting culture and supportive technology.
Role-based training
Different roles face different threats, and training should reflect that. We typically design distinct tracks for:
- Finance and payments teams, focused on payment redirection, supplier impersonation and executive fraud, with rehearsal of verification procedures.
- Service desk and IT support, focused on caller identity verification, pressure tactics and escalation procedures for high-risk requests.
- Executives and their assistants, who are high-value targets for impersonation and whose public profiles make them easier to research.
- Human resources and recruitment, who handle sensitive personal data and are frequent targets of fake applicants and payroll diversion.
- All staff, with a focused baseline covering the most common attacks and, above all, how and where to report.
Realistic, continuous practice
Short, frequent exercises are far more effective than annual modules. Well-designed simulations (phishing, voice calls, text messages) mirror the attacks the organisation actually faces, increase in sophistication over time and provide immediate, constructive feedback. The purpose is learning, not catching people out.
Verification procedures that remove judgement from high-risk moments
The most effective defence against social engineering is often procedural. If every change to supplier bank details must be verified by calling a number already held on file (never one provided in the request), then even a perfectly convincing impersonation will fail. Clear procedures take the pressure off individuals: they do not need to judge whether a request is genuine, only to follow the process.
High-value verification procedures typically cover:
- Changes to payment details for suppliers, customers or employees.
- Urgent or unusual payment requests, particularly those that bypass normal approvals.
- Password and MFA resets requested by phone or chat.
- Requests for sensitive data from outside normal channels.
- Instructions attributed to senior executives that arrive through unusual routes.
A reporting culture
The speed at which a suspicious message is reported often determines how much damage it can do. A single report can allow the security team to remove the same email from every inbox before others act on it. Organisations should make reporting simple (a single button in the email client) and should thank people for reporting, including when the message turns out to be harmless or when they reported after clicking.
Technology that supports people
Technology cannot eliminate social engineering, but it can reduce exposure and make the right behaviour easier. Useful measures include phishing-resistant multi-factor authentication, which defeats credential-phishing and push-fatigue attacks; external email tagging; domain monitoring for lookalike registrations; and payment controls that require independent approval for changes to bank details.
Measuring what matters
Effective programmes measure behaviour, not attendance. The metrics we recommend include:
- Reporting rate: the proportion of simulated attacks that are reported, which should rise over time.
- Time to report: how quickly the first reports arrive after a simulated or real attack.
- Failure rate by role: the proportion who act on a simulated attack, tracked separately for high-risk functions.
- Verification adherence: whether high-risk procedures, such as call-back verification for payment changes, are followed in testing.
- Real-world indicators: the number of genuine attacks reported by staff and the incidents prevented as a result.
A rising reporting rate is often a better sign of programme health than a falling click rate. It shows that people are engaged, confident and part of the organisation's defence.
Preparing for AI-enabled attacks
Generative AI is making social engineering more scalable and more convincing. Phishing emails no longer contain the spelling mistakes people were taught to look for. Voice cloning can reproduce a familiar executive's voice. Attacks can be personalised at scale using information gathered automatically from public sources.
The implication is that training focused on spotting surface-level signs of fraud is becoming less effective. The emphasis must shift towards process: verifying through independent channels, pausing when a request is urgent and unusual, and recognising that a familiar voice or face is no longer proof of identity. Agreed verification phrases or call-back procedures for high-value requests are becoming a sensible precaution for executives and finance teams alike.
Building the human layer
Security technology will continue to improve, and it should. But as long as organisations depend on people to make decisions, attackers will target those people. The organisations that are most resilient are not those whose employees never encounter a convincing attack. They are those whose employees recognise the pattern of an unusual request, follow a clear verification process, and report quickly without fear.
Our infosec training practice designs programmes around exactly that goal: role-specific, practical and measured by behaviour change rather than completion rates. The human layer can be the weakest link in an organisation's defences. With the right approach, it can become one of the strongest.