While it’s easy to look at the modern threat landscape as a cat-and-mouse game between sophisticated threat actors utilizing high-tech methods to hack their way into valuable systems, the reality can be far less dramatic, albeit equally as precarious.
Threat actors are increasingly seizing on the human element — unaware or easily manipulated users — as a weak link in the security chain and are deploying tried-and-true social engineering attacks to trick users into granting them access, handing over key credentials, or unknowingly providing funds. Social engineering, which relies on a bit of human psychology and a lack of security awareness, allows threat actors to achieve their goals — or at least gain initial access to a network — quickly and easily.
To put the prevalence of social engineering into context, consider the following: three-quarters of business email compromise (BEC) attacks investigated by Arctic Wolf® Incident Response in 2024 originated with phishing (73.5%) and other social engineering tactics (2.3%). According to the 2025 Verizon Data Breach Investigations Report, 60% of breaches in 2024 involved the human element, and almost a quarter of those (22%) originated with social engineering, with phishing as the top attack type.
It’s clear that social engineering is a favorite technique in threat actors’ tool kits, and it’s not going away any time soon. It’s important for organizations to understand how this approach works, what it can look like in their environment, and how they can minimize human risk while securing their most valuable assets and access points.
What is Social Engineering?
Social engineering refers to the (often virtual) ploy used by threat actors to gain access or data from unsuspecting human victims. Social engineering attacks work by manipulating individuals into handing over access, credentials, data, or even funds, unknowingly, to threat actors, using human psychology and often clever impersonation.
Social engineering can occur through multiple mediums, including email, phone, SMS messaging, websites, and real-life actions, and can contain a variety of goals. While social engineering attacks can target a single individual with a single end goal, for example sending one person a misleading text message in hopes they hand over banking information (this is a common social engineering scam that targets elderly individuals), more frequently social engineering is just one approach used by threat actors in a larger, more complex attack on an entire organization. Additionally, social engineering often relies on what’s known as pretexting, or the creation of a false narrative or scenario intended to trick the target into completing a desired task.
Social engineering is most often employed in the early stages of a cyber attack — during the reconnaissance or initial access phases — to help threat actors learn more about their target and gain access to the environment as a whole or to specific parts, including high value applications or assets.
Additionally, multiple kinds of social engineering attacks can be used in tandem. For example, business email compromise (BEC) attacks are a kind of social engineering attack highly dependent on another kind of social engineering: phishing. A vishing (voice-phishing) attack can occur after a phishing email has been sent to a target to increase the odds of success, and an SMS social engineering attack can be used to spur a user to accept a multi-factor authentication (MFA) prompt during an MFA fatigue attack. All these techniques work together to help ensure success for the threat actors.
The Social Engineering Attack Cycle
While every social engineering attack may look different in terms of procedures and goals, each follows the same cycle consisting of four parts:
1. Information gathering. This stage involves the threat actor researching the target to find what weaknesses and mediums will work best for the attack. This can include obtaining phone numbers, email addresses, information about the place of work, or even intelligence on an individual’s personal life, often gathered from social media accounts.
2. Establishing a relationship. This stage involves the threat actor laying out the plan of attack. It could involve choosing to target a specific department of an organization with a phishing email or impersonating an assistant to the CEO with a BEC attack.
3. Exploitation. This is the attack itself. This is a phishing email, BEC attack, or other social engineering attack technique.
4. Execution. This occurs when success is achieved, be it financial gain, granted access, or another successful outcome as determined by the threat actor.
This cycle can be repeated multiple times, and various stages can occur in tandem as well. For example, if a threat actor is mass- emailing an entire department of an organization with a spam phishing technique, part two and three may repeat until execution is achieved.
Why is Social Engineering So Effective?
The human element has become an increasingly large part of organizations’ attack surfaces, so threat actors know targeting that element can be an effective way to gain initial access to an environment. Unlike high-tech security solutions, humans are unpredictable in their behavior and can be tricked into handing over valuable access without ever realizing they have done so.
Notorious cyber gang Scattered Spider is a great example of the power of social engineering. The group, which was recently named as one of the culprits behind the massive Marks & Spencer data breach in the U.K., often turns to social engineering for initial access during attacks, allowing them to move undetected in a network and launch sophisticated ransomware — and all it takes is an impersonation maneuver and a too-trusting employee.
Other reasons threat actors employ social engineering include:
- Social engineering enables access to an environment, network, applications, or assets without the need for technical maneuvers
- Social engineering plays on common human emotions, such as fear, urgency, and/or trust
- Social engineering attacks are often highly targeted (increasingly so due to the power of AI), allowing threat actors to exploit the exact right individual for the exact right access
- Potential victims may lack security awareness training and are unable to spot potential social engineering attacks
- Organizations can lack security controls designed to prevent social engineering attacks (including security awareness training, multi-factor authentication [MFA], email security, and identity or access monitoring)
- Successful social engineering allows threat actors to digitally walk into an environment, often while evading detection, and complete their subsequent attack actions and goals
Additionally, like a Swiss Army knife, this attack type can contain many options, allowing threat actors to deploy the specific tactic most likely to succeed in a given scenario.
Types of Social Engineering Attacks
1. Phishing
One of the most well-known and common forms of social engineering, phishing occurs when a threat actor communicates with a target, posing as a known or trusted entity, with the intention of getting the target to complete a desired task (e.g. click on a malicious link, hand over credentials, grant access, or even submit funds).
While email is the most prevalent form of phishing, that attack can take many forms, including:
- Spam (or mass) phishing
- Spear phishing
- Whaling
- Vishing
- Smishing
- Angler phishing
- URL phishing
Explore phishing in-depth.
2. Business email compromise (BEC)
A BEC attack occurs when the email account of a user has been compromised, or is impersonated, and is then used to gain financial information, or access information or payment from other users. Commonly, after gaining access to the desired email account, the threat actor will send out fake emails requesting the transfer of funds. These attacks are both common and lucrative — accounting for 27% of Arctic Wolf Incident Response investigations in 2024 and costing global organizations $55.5 billion (USD) between 2013 and 2023. The tactic discussed above, phishing, is often determined to be the root point of compromise to BEC attacks. Unlike other social engineering attacks, a BEC attack often exists unto itself, meaning that once the attack is complete, threat actors often leave the environment instead of moving deeper into it to launch another attack.
Explore business email compromise in-depth.
3. Baiting
Baiting uses a false promise of something desirable (e.g. an online ad for a free game, deeply discounted software, etc.) to trick a target into revealing sensitive personal or financial information or even infect their system with malware or ransomware.
4. Scareware
Scareware attacks use pop-up ads to frighten a user into buying and/or downloading malware. This attack is often deployed with the pretext that their system is infected with a computer virus, and that they need to purchase the offered antivirus software to protect themselves.
5. Tailgating
A real-world form of social engineering, tailgating occurs when an individual attempts to gain unauthorized physical access to secure spaces such as an office building or server room through coercion or deception.
6. Shoulder surfing
Another IRL example of social engineering, shoulder surfing involves the surveillance of sensitive data in public spaces like airports and coffee shops. It can also involve the surveillance of an unlocked, unattended laptop or mobile device in an organization.
7. Spoofing
A spoofing attack occurs when a threat actor disguises their identity when contacting a social engineering target, so that the contact appears legitimate. Spoofing can be used in phishing attacks where the threat actor is posing as someone known or trusted during the attack.
Spoofing attacks can take many forms, including:
- Website spoofing
- DNS spoofing
- Text message/SMS spoofing
- Domain spoofing
- Email spoofing
- IP address spoofing
- GPS spoofing
Explore the various types of spoofing attacks in-depth.
8. Quid Pro Quo
In this form of social engineering, the threat actor will offer the target a service or benefit in exchange for access, sensitive data, or funds.
How To Defend Against Social Engineering Attacks
Combating social engineering is a multi-front war. From preventing credential theft to employing email filters and email security to making sure users are properly trained against social engineering, a strong strategy within this field of cybersecurity is one that employs multiple methods of defense simultaneously.
Let’s look at how to defend the target — the human element — first.
Security awareness training
Because users are the main target in social engineering attacks, the users themselves are the first and best line of defense. Reducing human risk lowers the chances of a social engineering attack succeeding within your organization. However, it’s an element that can be overlooked by leaders when implementing a security strategy. In a recent survey by Arctic Wolf, only 31% of global respondents stated that “building a culture of security awareness” was a primary driver of their security strategy.
Strong security awareness training should include:
- Up-to-date, relevant content
- Empowering language that treats users as an asset, not a weak link
- Phishing simulations to track progress and test skills
- Microlearning for better retention and understanding
- Education that builds an organization-wide culture of security
While security awareness training serves a vital role in stopping social engineering, it is not the only defense organizations can deploy to prevent, detect, and respond to social engineering attacks.
Combatting social engineering with technology
There are multiple security solutions designed to help an organization detect a social engineering attack, stop it before a user falls for potential exploitation, or even shut down the incident early in the kill chain.
These solutions include:
1. Multi-factor authentication (MFA). A relatively simple form of access control, MFA can go a long way in stopping unauthorized access and helping security teams detect unusual and possibly malicious access behaviors. However, this control is often underutilized, which can come with consequences. In the same survey mentioned above, Arctic Wolf found that more than half of the organizations that experienced a significant cyber attack in 2024 had not implemented MFA.
2. Implement least privilege access controls. By limiting access as much as possible — in this instance ensuring that employees only have access to the data and systems necessary for their roles — your organization can prevent a threat actor from moving laterally within the environment or gaining access to valuable assets and applications. This measure can stop an incident before it evolves if the initial social engineering attack was successful, as well as buy security teams time to detect the potential intruder.
3. Email security measures. Email security solutions can not only filter out spam, flag suspicious emails, and detect possible BEC attacks, but can also create an avenue for employees to flag and report potential phishing or social engineering-related emails, giving security teams’ insights into the prevalence of this threat within their organization.
4. Managed detection and response (MDR). This detection and response technology can not only monitor access points, endpoints, applications, and even identity telemetry 24×7, but can also alert security teams to suspicious user activity (such as logins from an unusual geographic location, data exfiltration, or other suspicious user behavior) to prevent social engineering-borne incidents from evolving into serious data breaches.
Social engineering and the end user
While the two main categories of defense above can be implemented by an organization’s IT or security departments, the real risk of social engineering lies with the end user. It’s important for organizations to continually make their users aware of social engineering tactics and how their users may be targeted to reduce human risk business- wide.
Warning signs of social engineering which end users should be aware of include:
- Emails or phone calls from unknown or new senders with unexpected requests
- Pressure to act quickly or messaging language that creates an emotional reaction such as urgency or fear
- Suspicious sender/communicator information, including but not limited to an unrecognized phone number, unknown email address, and unknown identity or odd identity features (e.g. a name or role you have not previously encountered in your work or personal life)
- Odd grammar, misspellings, or other suspicious communication features
- Requests for sensitive information (e.g. financial information, credentials, or access to an application)
- Prompt to click on a link that looks unknown or suspicious
- The sender/communicator is unwilling to verify their identity
Learn how Arctic Wolf’s Managed Detection and Response solution was able to correlate multiple data points and take swift action against a BEC attack.
Understand how a robust security awareness training program can transform your organization’s defense and security culture.
