People always ask me about social engineering like it is some kind of dark art. It is not. It is actually pretty simple once you understand the goal.
The goal
The goal of social engineering is to manipulate people into performing actions or divulging confidential information that benefits the attacker. That is the textbook definition and it is accurate.
But let me put it in more practical terms. The goal is to bypass technical security controls by exploiting the human element. Why spend weeks trying to crack a firewall when you can call the help desk and get them to reset a password for you?
Common objectives
Social engineering attacks typically aim to achieve one or more of these objectives:
- Credential harvesting – Getting usernames, passwords, or access tokens through phishing emails, fake login pages, or phone calls impersonating IT support
- Malware delivery – Convincing someone to open a malicious attachment, click a link, or insert a USB drive
- Physical access – Tailgating into secure areas, impersonating vendors or employees, or social engineering reception staff
- Information gathering – Extracting organizational details, network information, or employee data that can be used in more targeted attacks
- Financial fraud – Business email compromise (BEC), invoice fraud, or wire transfer manipulation
Why it works
Social engineering works because humans are wired to be helpful, to trust authority, and to respond to urgency. Attackers exploit these traits consistently. They create scenarios that trigger emotional responses – fear, curiosity, greed, helpfulness – that override rational decision making.
The best defense is awareness combined with process. Teach people to recognize the techniques, but also build processes that make it hard for social engineering to succeed even when someone falls for it. Require out-of-band verification for password resets. Use multi-factor authentication. Implement dual approval for financial transactions.
Technology alone will never solve this problem. It is a people problem and it requires people solutions.