Catalog
concept#Security#Governance#Integration#Product#Reliability

Social Engineering

Targeted manipulation of people to obtain sensitive information or induce unintended actions.

Social engineering describes targeted manipulation techniques that induce people to disclose sensitive information or perform unintended actions.
Established
Medium

Classification

  • Medium
  • Organizational
  • Organizational
  • Intermediate

Technical context

SIEM and incident response tools to detect consequencesHR systems for role and contact informationLearning management systems for awareness modules

Principles & goals

Human factors are the weakest link; measures must combine technical, organizational and cultural aspects.Continuous training and testing are more effective than one-off measures.Trust is context-dependent and must be supported by verifiable processes.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Loss of trust in internal communication if tests are too aggressive.
  • Legal or reputational consequences from poorly executed external communication simulations.
  • Overreliance on technical measures leads to process complacency.
  • Transparent communication about purposes and consequences of tests.
  • Follow-up with constructive feedback and training offers.
  • Combine technical blocks with process-oriented verifications.

I/O & resources

  • Asset inventory and list of key personnel
  • Communication channels and external interfaces
  • Legal framework and approvals
  • Vulnerability assessment and recommended actions
  • Training plans and awareness materials
  • Metrics to track improvements

Description

Social engineering describes targeted manipulation techniques that induce people to disclose sensitive information or perform unintended actions. It relies on psychological tactics, contextual knowledge and trust-building. Effective prevention combines technical controls, organizational policies and regular awareness training and testing to reduce human-targeted risk.

✔

  • Reduces successful attacks by increasing awareness.
  • Improves reporting patterns and incident response capability.
  • Helps reveal organizational weaknesses.

✖

  • Human behavior cannot be completely eliminated.
  • Training only works if it is regular and relevant.
  • Technical controls alone often do not prevent targeted manipulation.

  • Phishing click rate

    Proportion of employees who click on a test phishing link.

  • Reporting rate

    Proportion of employees who report suspicious incidents.

  • Time to respond

    Average time until detection and reporting of an incident.

Phishing campaign in a public authority

Attacker used forged sender addresses and form links to steal credentials.

Vishing attack on helpdesk

Telephone attacker impersonated an internal colleague and obtained password reset details.

Social media identity building

Attacker built a credible profile over weeks and gained employee trust.

1

Perform gap analysis of current awareness and testing processes.

2

Define governance, policies and approval workflows.

3

Plan pilot tests, run them and scale based on results.

⚠️ Technical debt & bottlenecks

  • Outdated contact lists and role descriptions.
  • Missing automation to measure awareness metrics.
  • Insufficient integrations between LMS and SIEM.
Insufficient training frequencyUnclear verification processesLimited monitoring capacity
  • Simulating public announcements without legal review, leading to PR issues.
  • Test phishing containing sensitive content that exposed personal data.
  • Legally questionable impersonations in external contacts.
  • Excessive secrecy prevents necessary follow-up.
  • Lack of documentation of tests and results.
  • Not involving legal and HR before tests.
Knowledge in security psychology and threat modelingExperience in incident response and communicationLegal understanding of testing and data protection requirements
Protection of critical data and access controlsOrganizational culture and risk appetiteProcess security for identity and authorization checks
  • • Consider data protection regulations in test scenarios
  • • Budget and time resources for regular measures
  • • Legal requirements for external communications and simulations