What Is Social Engineering?
Social engineering is the use of psychological manipulation to trick someone into giving up confidential information, granting access, or taking an action that compromises security. Rather than exploiting a technical flaw, social engineering exploits human tendencies: trust, urgency, fear, helpfulness, and the desire to avoid conflict or embarrassment.
Phishing, smishing, vishing, and pretexting are all forms of social engineering. What unites them is the same underlying approach: the attacker studies how people normally behave and designs a scenario that makes the harmful action feel reasonable in the moment.
A social engineering attempt might involve someone posing as a new employee who has forgotten their badge and needs to be let into a building, a caller claiming to be from IT support who needs a password to "fix an issue," or an email that mimics the exact tone and format of internal communications.
Because social engineering targets people rather than systems, no firewall or antivirus tool can fully prevent it. The most effective countermeasure is ongoing awareness: helping employees recognize the patterns attackers rely on and giving them confidence to pause, question, and report unusual requests.