You can buy the best security tools made and harden every server in the building, and a polite stranger with a clipboard can still walk past all of it. The human layer is where security breaks, and it’s the part almost nobody is ready for.
I ran technology and security for a national retailer for two decades. I was also the technical editor on Cyberheist, the book by KnowBe4 founder Stu Sjouwerman, a book about this problem. Now I ghostwrite books for security leaders. Across all of it, the same truth holds. People are the easiest way in.
You can harden every server in the building. A stranger in a uniform with a clipboard still walks right past all of it.Share on X
Social engineering works because of something good about people. Most of us are helpful, and most of us don’t expect to be lied to. We don’t walk around assuming the person in front of us is evil. That assumption is pleasant to live with and dangerous at work.
The attacker exploits a handful of reliable human instincts. We want to be helpful, so we hold the door and answer the question. We respect authority, so we do what the badge or the title tells us. We avoid conflict, so we don’t challenge the confident stranger. We respond to urgency, so we act before we think when something seems time-critical. Those instincts make people decent and functional, and the attacker turns them into tools. That’s what I find ugliest about social engineering. It punishes people for being good coworkers.
My take
Train your people hard and keep training them, since attackers go after staff before they bother with the servers. You can lock down every server in the building and a polite stranger with a clipboard still walks in. Social engineering preys on helpful, decent coworkers, and I find that ugly. Teach people that it’s fine to challenge the badge, call back the friendly voice, and slow down on anything urgent. A once-a-year video won’t do it.
What does an in-person social engineering attack look like?
Think about how this plays out. A man shows up in a uniform, with a tag that looks official, and says he needs to get into the computer room to install a new router. Nobody expects him to be a hacker. He looks right. He sounds right. He has the confidence of someone who belongs. Somebody lets him in, because stopping him would mean being rude to a person who’s obviously just doing his job, and most people won’t do that.
Or the phone rings, and a friendly voice asks for a piece of information, and the employee just gives it out, because why would they not?
The caller seems to belong, mentions a name the employee recognizes, references something real about the company. Nobody expects the question itself to be the attack. That’s the game. The attacker breaks nothing. They borrow your trust and your good manners and use them against you.
Phishing is the version everyone has seen. An email that looks like it comes from someone you trust, asking you to click a link or hand over a password. It’s social engineering, just delivered by email instead of in person, and it works for the same reason: it looks like it belongs.
Most phishing is general. The attacker sprays the same fake email at thousands or millions of people. A fake bank notice. A fake delivery alert. A fake password reset. Then he waits for the small percentage who click. They don’t care that most people delete it. They only need a fraction of a percent to act, and at that scale, a fraction of a percent is a lot of victims. It’s a numbers game, and the numbers work in the attacker’s favor every time.
This is the exact vector that turns into ransomware, the one I describe in what actually gets attacked first. An employee clicks a link in a convincing email, and the malware is in. No firewall stopped it because the employee invited it in. That’s why the human layer outweighs the perimeter.
When they come for you
It gets more dangerous when the attack is aimed at your company on purpose. That’s spear phishing. The attacker researches you, learns your names and your structure, reads your company’s public information and your employees’ social media, and writes a message tailored to fool your specific people. It’s far more convincing because it’s not generic. It uses the name of your actual CFO, references a real project, mimics the tone of internal email. The mass phishing email is a stranger guessing. The spear phishing email is someone who did their homework.
Then there’s whaling. That goes after the big targets.
The CEO, the CFO, the people who can authorize money or access. A well-crafted message that appears to come from the boss, telling someone to wire funds or send data, can work because people don’t question authority in a hurry, and they especially don’t question the person who can fire them.
The classic version is the urgent email from the CEO to someone in finance: I need this wire sent now, I’m in a meeting, don’t call me.
Every detail is engineered to short-circuit the pause that would catch it. The bigger the target, the bigger the payoff, so attackers invest real effort in these. They’ll study a company for weeks to land one convincing message.
Whaling is an ugly crime in a particular way. The person who gets fooled is usually a conscientious employee doing exactly what the boss seemed to ask. Afterward the company wants someone to blame, and too often it falls on the clerk who sent the wire, when the real failure belongs to leadership that never required a callback before large transfers.
Phishing works because the email looks like it belongs. Spear phishing works because the attacker learned your names first.Share on X
You can’t patch a human being. The defense against social engineering is awareness, training that’s real instead of a box-checking exercise. People have to learn to expect the trick, to feel the small wrongness when the uniform is a little too convenient or the request is a little too urgent or the email from the boss is a little off in its phrasing.
The training has to change behavior. The annual video everyone clicks through while doing something else accomplishes nothing, and I’m tired of companies calling that a security program. Real awareness training is repeated, specific, and practiced. It teaches people the actual patterns: the urgency that doesn’t make sense, the authority nobody can verify, the request that breaks normal process.
And it gives them permission to pause and check, the thing they most need, because the social pressure to be helpful and not challenge authority is exactly what the attacker is counting on. An employee who feels allowed to say let me verify that and call you back has defused most of these attacks before they start.
That’s the hardest thing to teach, because you’re asking friendly, trusting people to add a layer of suspicion they’d rather not carry. But the employee who pauses and asks one extra question is worth more than any firewall. The point of a book like Cyberheist was to make ordinary people see the con before they fall for it, to install that instinct in people who would otherwise be too polite to use it.
This is also why the security leaders I ghostwrite for have something. The technical defenses are well documented, and a lot of the tools sold to address them are theater, which I cover in most security tools are theater. The judgment about how people behave under pressure, and how to build a culture that resists manipulation, is the rare and valuable part. That’s the material a real book preserves, and it’s what readers can’t get from a vendor brochure.
I think every company that takes security seriously owes its people two things: real practice at spotting the con, and a standing promise that nobody gets punished for stopping to verify. Skip either one and the next polite stranger with a clipboard gets in, whatever the firewall cost.
Frequently Asked Questions
It’s manipulating people into giving up access or information, instead of attacking technology. It works because people are helpful, respect authority, avoid conflict, and respond to urgency, all good instincts the attacker turns into tools. A stranger in a convincing uniform or a friendly caller can get past defenses that no hacker could break technically.
Phishing is a generic fake message sprayed at many people, hoping a few click. Spear phishing is aimed at one company, using researched details, real names and projects, to seem authentic. Whaling targets the big fish, executives who can authorize money or access, with a carefully engineered con. The more specific the attack, the more convincing and dangerous.
Because you can’t patch a human, and most people don’t expect to be deceived. The technology can be locked down, but a person can be talked into opening the door. Attackers exploit good qualities, helpfulness, respect for authority, the wish to avoid conflict, and that’s why the human layer is so hard to defend.
With real security awareness training that changes behavior, which the annual video nobody watches never does. People have to learn the actual patterns, unverifiable authority, urgency that makes no sense, requests that break normal process, and be given explicit permission to pause and verify. The employee who feels allowed to say ‘let me check and call you back’ has defused most of these attacks.
Whaling is social engineering aimed at high-value targets like the CEO or CFO, or aimed at staff by impersonating them. The classic version is an urgent email appearing to come from the boss, telling finance to wire money immediately, engineered to short-circuit the pause that would catch it. The high payoff justifies the attacker studying the company for weeks.
Yes, and I was technical editor on Cyberheist, KnowBe4’s book on exactly this topic. I ghostwrite for CISOs, security founders, and technical executives who want their judgment about real-world risk on the page. You can see how I work on the cybersecurity ghostwriting page.
Attackers count on people trusting the wrong message. I wrote Family Cybersecurity to help you protect your own household, starting with one ordinary attachment that wiped out thirty years of family photos.
