Phishing is one example of a bigger idea: attacking people rather than machines. That idea is called social engineering.
What is it?
Social engineering is the art of manipulating people into giving up information or access. Instead of breaking through technology, the attacker tricks a person into opening the door for them.
Select any component in the diagram to read what it does.
Text description of this diagram
Social engineering manipulates people — not computers — into breaking security, usually by creating trust or pressure.
Why is it important?
The most up-to-date firewall cannot stop an employee who is tricked into handing over their password. People are often the easiest target, which is why attackers invest so much effort in manipulating them — and why awareness is such a powerful defence.
How does it work? — common tactics
- Pretexting — inventing a believable story (“I’m from IT support”).
- Baiting — leaving a tempting trap, like a USB stick labelled “Salaries”.
- Tailgating — following an employee through a secure door.
- Impersonation — pretending to be a boss, colleague, or trusted company.
They rely on human instincts: the wish to be helpful, respect for authority, fear of getting in trouble, and curiosity.
A real-world example
An attacker phones a help desk pretending to be a panicked senior manager locked out before an important meeting (pretexting + authority + urgency). The helpful agent resets the password without checking properly — and hands control of a real account to a stranger. A simple verification step would have stopped it.
Check what you learned
What is social engineering?
Manipulating people into giving up information or access, rather than breaking through technology.
Which human instincts do social engineers exploit?
The wish to be helpful, respect for authority, fear, and curiosity.
Key takeaways
- Social engineering attacks the person, not the machine.
- Tactics include pretexting, baiting, tailgating, and impersonation.
- Awareness and verifying requests are the best defences.