Social engineering assessments and building awareness
In short: Social engineering tricks people into giving access, information or money. Organisations test their resilience with authorised phishing simulations, phone pretexts and physical tests, then use the results to improve training and processes rather than to blame staff.
Why people are targeted
Social engineering is manipulating people into doing something that helps an attacker: clicking a link, revealing a password, paying a fake invoice or holding a door open. It works because it exploits normal, helpful behaviour. Common levers include authority (a message appearing to come from the CEO), urgency ("your account closes today"), fear, curiosity and helpfulness.
Common techniques
- Phishing: deceptive emails. Spear phishing targets specific people using details from OSINT; whaling targets senior staff.
- Business email compromise (BEC): impersonating a manager or supplier to redirect payments.
- Vishing and smishing: phone calls and text messages, for example a fake help desk asking you to approve an MFA prompt.
- Pretexting: inventing a believable story, such as a new contractor who "just needs" a password reset.
- Tailgating: following an authorised person through a secure door.
- Baiting: leaving infected USB drives or offering something free.
Running an ethical assessment
A social engineering assessment tests people and processes, so it needs extra care. Get written approval from senior management and agree it with HR and legal. Keep a small group informed so a real panic can be stopped.
| Assessment | What it measures | Ethical care points |
|---|---|---|
| Phishing simulation | Click, credential entry and reporting rates | Avoid cruel lures such as fake pay rises or health scares; never collect real passwords |
| Vishing (phone pretext) | Whether help desk staff verify callers | Agreed script; no threats; stop if a person is distressed |
| Physical test | Tailgating, badge checks, unlocked rooms | Carry an authorisation letter and a contact who can confirm it |
| USB drop | Whether staff plug in unknown devices | Use harmless beacon files only |
Report results by department and trend, not by naming individuals. The most useful metric is often the reporting rate: how many people told security about the suspicious message, and how quickly.
Building awareness that lasts
- Keep training short, frequent and relevant to each role (finance staff need invoice fraud examples).
- Make reporting easy, with a single button in the mail client, and thank people who report.
- Fix processes, not just people: require call-back verification for bank detail changes and identity checks for password resets.
- Back awareness with technical controls such as email filtering, MFA and link scanning.
- Share real (anonymised) examples so the threat feels concrete.
Tip: a culture where people fear punishment for clicking will hide incidents. A culture that welcomes reports finds them early. See phishing basics for what users should look for.
Practice
Which metric often says more about a phishing simulation than the click rate?
A caller claims to be from IT and asks a user to read out an MFA code. Which technique is this?
Name one process change that defeats invoice fraud by email.
Key takeaways
- Social engineering exploits authority, urgency, fear, curiosity and helpfulness.
- Techniques include phishing, BEC, vishing, smishing, pretexting and tailgating.
- Assessments need written approval, HR and legal agreement, and careful lures.
- Report trends, not names, and track the reporting rate.
- Combine training with process fixes and technical controls.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.