Social engineering manipulates people into revealing information, granting access, or performing actions that compromise security. Modern campaigns extend beyond deceptive email into coordinated voice, SMS, targeted, executive-focused, and business email compromise attacks. Effective protection therefore combines user training with multifactor verification and layered controls. section 1.4
Common forms connect the human target, the communication channel, and the attacker’s credibility strategy:
- Vishing uses voice calls, while smishing uses SMS messages. section 1.4
- Spear phishing targets specific individuals, and whaling targets executives. section 1.4
- Business email compromise can use deepfake tactics, including voice cloning, to make fraudulent requests appear trustworthy. section 1.4
A cloned IT support call
An employee receives an email requesting a password reset, followed by a call from someone who sounds like a trusted IT staff member. The attacker uses the cloned voice to guide the employee toward a cloned system that captures credentials. Multifactor verification and robust training reduce reliance on apparent identity or urgency. section 1.4
AI increases the sophistication of social engineering through deepfakes, while also introducing uncertainty through bias and false positives. AI-based defenses work best alongside rule-based detection, behavioral analysis, traditional controls, and human oversight rather than as a standalone solution. section 1.7
