ROME, July 17 — Social engineering has become one of the most quietly pervasive threats in cybersecurity, and for good reason: it targets the one thing no firewall can fully protect — human trust. The technique, broadly defined as any act that influences a person to take an action that may or may not be in their best interests, relies on psychological pressure rather than technical hacking.
It is a type of confidence trick, but unlike a traditional con, it is often just one step in a larger, more complex fraud scheme.
How the tricks work
Researchers have catalogued several distinct methods, each exploiting specific cognitive biases. Pretexting — known as blagging in the UK — involves an attacker creating an invented scenario to increase the chance a victim will divulge information. Perpetrators often conduct prior research to impersonate someone credible, using details like a date of birth or Social Security number to build false legitimacy.
Water holing takes a different approach. Attackers capitalise on trust in regularly visited websites, preparing traps at the digital locations their targets frequent.
The victim walks into the ambush by doing nothing more than visiting a site they already know. Baiting uses physical media. Attackers leave malware-infected USB drives in public places — bathrooms, elevators, parking lots — with enticing labels such as “Employee Salaries” or “Confidential.” A 2016 study saw researchers drop 297 USB drives to test this method.
The results were a stark reminder that curiosity often overrides caution.
A growing challenge
Phishing, a well-known subset of social engineering, has become a household term. But the broader category includes everything from an attacker posting a fake help desk number on a company bulletin board to collect passwords, to a hacker gaining trust on a social networking site to obtain sensitive information. In 2019 and 2020, researchers stated that social engineering was an increasingly important challenge for organisations and countries alike.
Reports indicated that through 2024, social engineering attacks had increased in intensity and number. The trend shows no sign of slowing.
Detection techniques have been developed, and cybersecurity educational programmes now exist to help people recognise the signs. But the attackers adapt. The psychological pressure they apply evolves as quickly as the defences meant to stop it.
What this means going forward
For anyone who has ever received a suspicious email or found a stray USB drive, the lesson is straightforward: the pressure to act quickly, to trust a familiar name, to satisfy curiosity — these are exactly the buttons social engineers push. The human side of security remains the most vulnerable link, and no software patch can fix it.
