Social engineering

Social engineering targets the human layer. Instead of finding a software flaw, the attacker persuades someone to open the door: reveal a password, approve an MFA prompt, reset an account, plug in a USB stick or hold the office door. It works because it exploits normal, useful instincts such as wanting to help, respecting authority and acting fast when something seems urgent.

Phishing is the best-known form, but there are many others: pretexting (inventing a believable scenario, such as an auditor needing data), vishing (voice calls), smishing (SMS), baiting (leaving infected media to be found) and tailgating (following someone through a secured door).

Example

An attacker calls the IT help desk, claims to be a traveling sales manager whose phone was stolen, mentions the manager's real name and a real customer, and asks for an MFA reset. A helpful technician registers the attacker's phone on the account. Several well-known intrusions began exactly this way.

Why it matters for a SOC analyst

Many investigations end with "the user was tricked", and that is a finding about process, not just about one person. Help desk identity verification, out-of-band confirmation for payments and an easy way for users to report suspicious contact are what reduce the risk. When you write the incident report, describe the manipulation precisely: it is the most useful material for awareness training.