Social engineering: the underestimated threat in cybersecurity

Social engineering is one of the most serious threats in cybersecurity. It does not involve technical attacks, but targeted manipulation aimed at the human factor. Attackers exploit psychological mechanisms to build trust, create uncertainty and induce their victims to take actions that endanger the security of individuals and organisations. In an increasingly digitalised working world, understanding this threat is becoming decisively important.

Social engineering refers to the deliberate manipulation of people in order to get them to disclose confidential information, bypass security protocols or take actions that benefit the attacker. In contrast to purely technical cyberattacks that target weaknesses in software or infrastructure, social engineering uses people as the weakest link in the security chain.

The basis of every social engineering attack is trust. Attackers often invest considerable time and effort in building a trusting relationship with their victim or feigning credible authority. They research their targets thoroughly, collect publicly available information from social networks, company websites and other sources, and construct tailored attack scenarios from it.

The success of social engineering is based on a fundamental insight: technical security measures can be as sophisticated as they like, but if an employee voluntarily hands over their credentials to an attacker or holds the door to the server room open, all firewalls and encryption become ineffective. This circumstance makes social engineering one of the most effective and at the same time most cost-efficient attack vectors of all.

Social engineering works because it exploits deeply rooted psychological mechanisms. With his research on the principles of persuasion, social psychologist Robert Cialdini created a theoretical framework that explains the effectiveness of social engineering attacks. The following seven principles form the psychological foundation on which almost all social engineering techniques are built:

Reciprocity: people feel obliged to return favours. An attacker who first does their victim a small favour, for example by offering technical help or sharing a useful piece of information, creates a psychological debt that they can exploit later. This principle is frequently used in pretexting attacks in which the attacker poses as a helpful IT employee.
Consistency and commitment: people strive for consistency in their behaviour. Anyone who has once made a small commitment is more likely to agree to larger requests as well. Attackers use this through gradual escalation: they start with harmless requests and successively increase the demands until the victim discloses sensitive information.
Social proof: people orient themselves on the behaviour of others, especially in uncertain situations. Attackers use this principle by claiming that colleagues or superiors have already agreed to a certain action, or by using fake reviews and testimonials to suggest the trustworthiness of a fraudulent website.
Liking: people are more easily persuaded by people they like. Attackers deliberately build rapport, find common ground and show interest in the other person. In online contexts, fake profiles with attractive photos and carefully constructed biographies are used for this purpose.
Authority: people tend to follow instructions from authority figures without questioning them. Social engineers pose as superiors, IT administrators, police officers or bank advisers and exploit the natural respect for authority. This mechanism underlies many CEO fraud and BEC attacks.
Scarcity: things that are perceived as scarce or limited appear more valuable. Attackers create artificial scarcity, for example through time-limited offers that require immediate action, or by claiming that an account will soon be blocked.
Urgency: closely linked to the scarcity principle is the artificial creation of time pressure. Attackers push their victims to act quickly and thereby prevent critical thinking. Typical phrases are: “Your account will be blocked in 24 hours”, “The transfer must be made immediately” or “The CEO needs this right now”. Under time pressure people make worse decisions, a fact that social engineers systematically exploit.

Typical attack methods

Social engineering encompasses a broad spectrum of attack techniques that differ considerably in their execution and complexity. The following methods are among the most common and most effective.

Phishing and its variants

Phishing is by far the most widespread form of social engineering. In a classic phishing attack, attackers send mass emails that appear to come from trustworthy senders, such as banks, online services or public authorities. These emails contain links to fake websites or malicious attachments and aim to steal credentials or install malware.

The targeted variants are significantly more dangerous and harder to detect: spear phishing targets specific individuals or departments and uses individually researched information to increase the credibility of the message. The email refers to current projects, names colleagues or contains industry-specific terminology.

Whaling is a sub-form of spear phishing that specifically targets executives. Since decision-makers typically have far-reaching access rights and authorisation powers, they are particularly lucrative targets. Whaling attacks are often highly professionally designed and can cause considerable financial damage.

Smishing (SMS phishing) uses text messages as the attack vector. Typical examples are fake notifications from parcel services, banks or public authorities that entice the recipient to click on a link or call a phone number. The increasing use of smartphones for business purposes makes smishing a growing threat in the corporate context as well.

Baiting

In baiting, attackers lure their victims with a tempting bait. In the physical world this can be a USB stick with an interesting label that is “lost” in a company car park. Natural curiosity tempts finders to plug the stick into their computer, and thus to install malware. In the digital world, free downloads, exclusive content or supposedly useful software serve as bait. Baiting deliberately exploits human curiosity and the desire for a good deal.

Pretexting

Pretexting is a sophisticated social engineering technique in which the attacker constructs a complete false identity and a convincing scenario (the “pretext”) to gain the victim’s trust. The attacker poses, for example, as an IT support employee who needs to fix an urgent security problem, as a supplier who wants to clarify an outstanding invoice, or as a new employee who needs help setting up their access.

Successful pretexting requires thorough research and acting talent. The attacker must know the language, processes and culture of the target organisation in order to appear credible. In practice, experienced social engineers often combine pretexting with other techniques, such as a preceding phishing attack that provides the information needed for the pretexting.

Tailgating

Tailgating, also known as piggybacking, is a physical social engineering technique in which an attacker gains access to secured areas by following an authorised person through an access control. The attacker often poses as a supplier, tradesperson or new employee and exploits the natural politeness of people who hold the door open for their supposed colleague.

Tailgating is a serious problem especially in larger companies where not all employees know each other personally. It demonstrates impressively that cybersecurity does not end at the firewall but also includes physical access controls and employee awareness.

Business email compromise (BEC)

Business email compromise is one of the most financially damaging forms of social engineering. In a BEC attack, attackers compromise or imitate the email address of an executive or business partner and use it to initiate fraudulent payment instructions or the disclosure of confidential information.

The sophistication of modern BEC attacks is remarkable: attackers observe their targets’ email traffic for weeks or months, learn communication patterns and business relationships and then strike at exactly the right moment, for example during a business trip by the CEO or shortly before a known payment date. According to the FBI, BEC has caused more than 50 billion US dollars of damage worldwide in recent years.

Real cases and impact

Social engineering is not an abstract theoretical threat; it causes billions in damage worldwide every year. German mid-sized companies are particularly affected: many possess high-quality technologies and trade secrets but invest comparatively little in protection against social engineering attacks.

An exemplary case from the recent past concerns a German mid-sized company that fell victim to a CEO fraud attack. The attackers had monitored the email traffic of the executive management for weeks, analysed communication patterns and finally sent a deceptively genuine email in the name of the managing director to the accounts department. The instruction: a supposedly confidential transfer of several hundred thousand euros to a new business partner. As the email matched the usual communication style perfectly in language and content and was marked as absolutely confidential, the payment was made; the money was irretrievably lost.

The report of the German domestic intelligence service confirms these observations at national level: social engineering is increasingly used as a gateway for industrial espionage and targeted cyberattacks on German companies. State and non-state actors rely on manipulating employees to obtain confidential information that would be difficult to access through purely technical attacks.

German mid-sized companies face particular challenges when it comes to social engineering attacks. A study by the German Federal Office for Information Security (BSI) shows that around 40 percent of mid-sized companies have already been affected by social engineering attacks, and the number of unreported cases is probably significantly higher.

Several factors make mid-sized companies particularly vulnerable: many do not have dedicated IT security teams or a CISO (chief information security officer). Security training for employees takes place only sporadically, if at all. The flat hierarchies and short decision-making paths that characterise mid-sized companies are deliberately exploited by attackers: a direct call to the managing director or the accounts department is possible and effective in many cases.

In addition, mid-sized companies often act as suppliers to larger corporations and thus serve as a gateway for attacks on the entire supply chain. A compromised supplier can lead to the compromise of the entire network, a risk that is particularly explosive in the context of increasingly networked value chains.

Another critical factor is the often pronounced culture of trust in mid-sized companies. The close cooperation, personal interaction and mutual trust that make these companies strong are deliberately exploited by social engineers. In an environment where people know and trust each other, unusual requests are questioned less often, a circumstance that plays into the hands of attackers.

Preventive measures

Protection against social engineering requires a holistic approach that encompasses technical measures, organisational processes and employee awareness in equal measure. The following seven measures form the foundation of effective prevention:

1. Regular training and awareness programmes: the most important protective factor is informed and attentive employees. Training should not be understood as a one-off event but as a continuous process that includes current threats, real examples and practical exercises. Interactive formats such as simulated phishing campaigns, which make learning success measurable and sharpen awareness sustainably, are particularly effective.
2. Clear security policies and processes: define binding policies for handling sensitive information, verifying identities and authorising payments. A four-eyes principle should apply in particular to financial transactions, and payment instructions by email should always be verified via a second communication channel.
3. Multi-factor authentication (MFA): implement MFA for all critical systems and accesses. Even if an attacker obtains a password through social engineering, the second factor prevents unauthorised access. Prefer app-based or hardware-based solutions over SMS-based authentication.
4. Technical safeguards: use modern email security solutions that detect and filter phishing emails, prevent domain spoofing (SPF, DKIM, DMARC) and analyse suspicious links and attachments in a sandbox. Complement these with endpoint protection solutions and network monitoring.
5. Emergency plans and incident response: create clear instructions for the event of a detected social engineering attack. Employees must know whom to turn to if they receive a suspicious email, an unusual call or a questionable request. An open error culture, in which reporting suspicious incidents is expressly encouraged and not penalised, is essential.
6. Regular review of access rights: implement the principle of least privilege and review access rights regularly. Employees should only have access to the systems and data they actually need for their work. When staff change roles, rights must be adjusted or revoked promptly.
7. Regular tests and simulations: conduct social engineering tests regularly, such as simulated phishing campaigns, pretexting calls or physical access attempts. These tests provide valuable insight into the actual resilience of the organisation and identify areas where additional training or measures are required.

Conclusion: act now, before it is too late

Social engineering is and remains one of the most effective and most underestimated threats in cybersecurity. The increasing professionalisation of attackers, the use of AI technologies and the growing complexity of the digital working world continuously intensify the threat situation.

Organisations that regard social engineering as a purely technical problem fundamentally underestimate the danger. Protection against social engineering requires a holistic approach that puts people at the centre: informed employees, clear processes and a security culture that promotes attention and critical thinking.

The investment in prevention is far smaller than the potential costs of a successful attack: financial losses, reputational damage, legal consequences and the loss of trade secrets. Those who act now not only protect their data and finances but strengthen the entire organisation against a threat that will only increase in the future.

What is social engineering?

The psychology behind social engineering