What is social engineering?

Social engineering in plain English

You know the basic idea from everyday life: someone who walks confidently through a door wearing a high-visibility vest and carrying a clipboard is rarely stopped. After all, they look like they have business there. They don’t need to pick a lock – their demeanor is enough. Social engineering applies this trick to companies: by email, over the phone, or in person on-site.

Instead of painstakingly searching for technical vulnerabilities, attackers get employees to help them voluntarily: by revealing a password, opening a file, approving a bank transfer, or holding the door open. This works because the perpetrators exploit traits that are actually desirable in everyday work – helpfulness, trust, and the wish to get tasks done quickly.

Important: people who fall for social engineering aren’t naive. The attacks are professionally prepared and often catch people at a stressful moment. How vulnerable a company really is can be assessed realistically with a coordinated social engineering test.

How social engineering works

Most attacks follow a similar pattern:

1. Gathering information: The perpetrators analyze freely available sources – the company website, job postings, professional networks. This kind of research is called OSINT (open source intelligence).
2. Building a pretext: They slip into a believable role, such as IT support, a supplier, a new colleague, or the managing director. Experts call this pretexting.
3. Making contact and applying pressure: This happens by email, phone, text message, or in person. Typical levers are authority (“The boss needs this right away”), urgency, fear, or a small gift.
4. Reaching the goal: The victim discloses data, installs malware, transfers money, or grants physical access.

Well-known forms include phishing by email, vishing by phone, and smishing by text message. Then there’s CEO fraud: perpetrators pose as senior management and instruct staff to make payments. Rigged USB drives used as bait (baiting) and inconspicuously following someone through a secured door (tailgating) are part of the toolkit, too.

A practical example

The office manager of an engineering firm receives a phone call. The caller introduces himself as a technician from the firm’s IT service provider, names the account manager in charge, and mentions an ongoing project – all information he found online beforehand. He announces an urgent security update.

Shortly afterward, an email arrives with a link to a remote maintenance program. The office manager installs it because everything seems to add up. Finally, the caller asks for the verification code on her smartphone “so the update can go through.”

With that, he has access to her computer and her email account. One simple rule would have stopped the attack: calling the service provider back on the known number.

Why does this matter for businesses?

Firewalls, antivirus software, and encryption are of little help if someone voluntarily opens the door for attackers. That’s why social engineering is often the first step in larger attacks – from data theft to the encryption of entire networks by ransomware. Fake payment instructions also cause direct financial losses.

Lawmakers have the issue on their radar, too. The NIS2 Directive lists cybersecurity training among the mandatory measures for companies within its scope. Members of the management body are even required to take part in training themselves.

How to protect your organization

• Binding processes: Approve payments and changed bank details only after a callback on a known number and under the four-eyes principle (two-person approval).
• Clear rules for credentials: Passwords and verification codes are never shared – not even with IT or senior management.
• Raise awareness: Regular, hands-on training keeps your team up to date on current scams.
• Blame-free culture: Anyone who reports a mistake isn’t punished. That’s the only way you’ll learn about an attack early.
• Control physical access: Visitor badges, escorted guests, and secured doors make unauthorized entry harder.
• Reveal less: Check which details about processes and people are publicly visible.
• Test realistically: Coordinated, simulated attacks show where processes work and where they don’t. Involve the works council (employee representatives) and your data protection officer early on.

How Rootsektor can help

Under Social Engineering & Physical Testing, we offer authorized simulations of phishing, phone calls, and attempts to gain physical access – evaluated in a way that doesn’t expose individual employees. With Security Awareness & Phishing Simulation, we then strengthen your team in a targeted way. An OSINT assessment shows what information attackers can already find about your company today.