What is Social Engineering?
Social engineering is an attack technique in which an attacker manipulates people into disclosing confidential information, bypassing a security control or performing an action that grants access to systems, data or physical locations. Rather than exploiting a technical vulnerability, the attack targets human behaviour: trust, helpfulness, fear, curiosity or haste. That is why social engineering is often the first step in a larger attack involving malware or ransomware, in industrial environments too.
A firewall can block a network packet, but not an employee who holds the door open or reads out a login code.
🎯 What does an attacker want to achieve with social engineering?
Social engineering is rarely an end in itself. It is a means to gain initial access or to trigger a specific action:
- Credentials and tokens - passwords, MFA codes or session cookies to log in as a legitimate user
- Software installation - Malware or remote access tools that the employee launches themselves
- Bypassing controls - getting past access control, Zero Trust policies or physical entry gates
- Financial actions - a payment to a new bank account, as in CEO fraud; in 2024 the FBI recorded almost 2.8 billion US dollars in losses from business email compromise
- Information gathering - names, organisational structure, systems in use and suppliers, in preparation for a targeted attack
In the MITRE ATT&CK for ICS model the technique falls under Initial Access, for example as T0865 Spearphishing Attachment. According to the Verizon Data Breach Investigations Report 2025, the human element was involved in roughly 60 percent of the breaches analysed.
🧪 What forms of social engineering exist?
| Technique | Channel | How it works |
|---|---|---|
| Phishing | Email, website | Fake emails or cloned login pages that ask for data or get the victim to open an attachment |
| Spear phishing | Personally targeted phishing using knowledge of the target, their role and their colleagues | |
| Smishing | Text message, chat apps | Phishing via a text message, usually with a link to a fake page |
| Vishing | Phone | Calling as the helpdesk, a bank or a supplier to extract data or an action |
| Pretexting | All channels | Building a credible story (pretext), for example as an auditor or service engineer |
| Business email compromise | Impersonating an executive or supplier to divert a payment | |
| Baiting | Physical | Leaving an infected USB stick in a car park or canteen |
| Tailgating | Physical | Following an employee through a secure door or barrier |
| Quid pro quo | Phone, email | Offering a service, such as help with a fault, in exchange for credentials or an action |
| Deepfake | Video, voice | An imitated voice or video image of a manager |
Many attacks combine techniques. An attacker first gathers public information, then sends an email that appears to come from a known sender through spoofing, and finally phones to increase the sense of urgency.
🧠 Why does social engineering work so well?
Attackers use psychological principles of persuasion that psychologist Robert Cialdini described in 1984 in his book Influence:
| Principle | Example in an attack |
|---|---|
| Authority | ”This is IT, we need to reset your account right now.” |
| Urgency and scarcity | ”If you don’t sort this out before 4 pm, production will stop.” |
| Reciprocity | The attacker first helps with a small problem and then asks for something in return |
| Social proof | ”Your colleagues have already installed this update.” |
| Liking | Friendly, familiar contact via social media or a shared interest |
| Commitment and consistency | A small request first, followed by ever larger ones |
On top of that, social engineering is hard to detect with technical security alone. A valid login with stolen credentials looks like normal use in the logs. Attackers also deliberately pick people in key roles: system administrators, helpdesk staff, receptionists, finance staff and operators with access to the control system.
🏭 How does social engineering affect OT environments?
In industrial control systems, social engineering is often the route from the office network into production. Some well-known examples:
- Ukraine, December 2015 - on 23 December, three Ukrainian electricity distribution companies lost power for around 225,000 customers. The attackers got in via spear-phishing emails with malicious Office attachments that installed BlackEnergy, harvested legitimate credentials and then opened circuit breakers remotely through the SCADA environment.
- Scattered Spider - this group calls helpdesks and employees while posing as IT staff. According to a CISA advisory from November 2023, the group gets MFA reset to a device it controls, bombards users with MFA push notifications and has legitimate remote access tools installed.
- Deepfake fraud - in early 2024, an employee of engineering firm Arup in Hong Kong transferred around 25 million US dollars after a video call with imitated colleagues.
- Physical access - service engineers and suppliers often move freely around plants. Convincing workwear and a clipboard are sometimes enough to reach a PLC or engineering workstation.
In the 2025 attack on Jaguar Land Rover, many security vendors also cited a phone attack on the service desk, although JLR’s CISO at the time denied that social engineering was involved. At Colonial Pipeline, by contrast, a leaked password without MFA was enough: exactly the kind of credential that phishing harvests.
🛡️ How do you protect your organisation against social engineering?
An effective defence combines people, processes and technology following the principle of defence in depth:
- Awareness and training - provide role-based security awareness training with realistic phishing simulations and attention to phone, text messages and physical access. Reward reporting rather than punishing mistakes.
- Verification procedures - always verify requests about passwords, MFA resets, bank account numbers and access through a second channel: call back on a known number, never on the number in the message.
- Phishing-resistant MFA - use MFA based on FIDO2/WebAuthn or certificates. Text-message codes and push notifications are themselves vulnerable to social engineering through SIM swapping and MFA fatigue.
- Technical filters - email filtering with SPF, DKIM and DMARC, EDR on workstations and SIEM detection of anomalous logins.
- Limited privileges and controlled access - apply least privilege and route access to OT through a jump server with PAM, so that a single stolen account does not lead straight to the control system.
- Physical measures - visitor registration, escorted suppliers, locked cabinets and a USB policy for removable media.
- Fast reporting - make it clear where employees report suspicious situations so the CSIRT or incident response team can act quickly.
Test resilience periodically with a red team exercise or a penetration test that includes social engineering, and rehearse the response in a tabletop exercise.
⚖️ What do legislation and standards say about social engineering?
| Framework | Relevant requirement |
|---|---|
| NIS2 (EU 2022/2555) | Article 21 lists basic cyber hygiene practices and cybersecurity training; Article 20 requires members of management bodies to follow training themselves |
| Cybersecurity Act (Cyberbeveiligingswet) | Transposes NIS2 into Dutch law and has been in force since 15 August 2026 |
| ISO 27001:2022 | Control 6.3 requires information security awareness, education and training |
| IEC 62443-2-1 | The asset owner’s security programme includes staff training and awareness |
For organisations covered by the Dutch Cybersecurity Act, demonstrable training of staff and executives is therefore no longer optional. The Dutch NCSC also publishes current warnings about phishing campaigns.
❓ Frequently asked questions
What is the difference between social engineering and phishing?
Social engineering is the umbrella term for attacks that manipulate people. Phishing is one specific form of social engineering that works through email, fake websites or messages. Phone calls, tailgating and deepfakes also fall under social engineering.
Why is social engineering dangerous for OT environments?
Social engineering often provides the initial access an attacker needs to move from the office network into the production environment. With stolen credentials or an installed remote access tool, an attacker can reach control systems through lateral movement. The 2015 power outage in Ukraine started with spear-phishing emails.
Does MFA protect against social engineering?
MFA greatly reduces the risk, but not every form of MFA withstands social engineering. Attackers get codes read out to them, send repeated push notifications or have a phone number transferred through SIM swapping. Phishing-resistant MFA based on FIDO2/WebAuthn or certificates offers the best protection.
What is pretexting?
Pretexting is a social engineering technique in which the attacker uses a credible story or a false role, for example as a helpdesk employee, auditor or engineer. The story is meant to make the request seem logical. Pretexting is often combined with phone-based attacks (vishing).
How do you recognise a social engineering attack?
You recognise a social engineering attack by pressure and anomalies: unexpected urgency, an appeal to authority, a request to skip a procedure, or an unusual channel or sender address. If in doubt, verify the request through a known number or a colleague. Reporting afterwards is always better than staying silent.
Does security awareness training really help?
Security awareness training helps when it is regular, role-based and practical, with simulations and immediate feedback. Training alone is not enough: it works best combined with verification procedures, phishing-resistant MFA and technical detection. A culture in which reporting is valued is at least as important.
📌 In summary
Social engineering exploits trust, haste and helpfulness to get around technical security, making it one of the most common starting points for attacks on IT and OT environments. Defence requires a combination of training, fixed verification procedures, phishing-resistant MFA, limited privileges and a culture in which reporting is normal.