Security Monitoring · Topic 6 of 8
Social Engineering Attacks
Describe manual social engineering such as phishing and pretexting, and how generative AI makes lures, voice and video fakes more convincing.
- 4 min
- Social engineering targets people, not technology.
- Phishing is a broad lure, spear phishing is targeted, and whaling targets executives.
- Vishing uses voice calls and smishing uses text messages.
What it is
Social engineering tricks people into giving up access or information, instead of breaking technology.
Attackers aim at human habits such as trust, urgency and the wish to be helpful. A well made lure can bypass strong technical controls because the victim opens the door.
Generative AI has added a new angle. It helps attackers write better messages and fake voices and faces at low cost.
How it works
Social engineering follows a pattern of research, contact, persuasion and action, in both manual and AI assisted forms.
Manual techniques
| Technique | How it works |
|---|---|
| Phishing | A mass email that pretends to be a trusted sender and asks for a click or login |
| Spear phishing | A phishing message aimed at one person or group, using personal details |
| Whaling | Spear phishing aimed at senior executives |
| Vishing | Phishing by voice call |
| Smishing | Phishing by text message |
| Pretexting | An invented story or role, such as a fake help desk caller, used to gain trust |
| Baiting | Leaving something tempting, such as an infected USB drive, for the victim to use |
| Tailgating | Following an authorised person through a secure door |
| Business email compromise | Impersonating an executive or supplier to request a payment or data |
| Watering hole | Infecting a website that the target group is known to visit |
Most of these rely on urgency or authority. The message says the account will be locked, or the boss needs a payment now.
Generative AI techniques
Generative AI can produce text, audio, images and video from a short prompt. Attackers use it to make social engineering faster and more convincing.
- Better phishing text. Messages are fluent and free from the spelling errors that used to give them away. They can be translated and tailored to each target at scale.
- Personalisation. Public information from social media can be used to write a message that matches the target's job and interests.
- Voice cloning. A short audio sample can be used to imitate a manager on a phone call.
- Deepfake video. Synthetic video or images can impersonate a person in a call or in a profile picture.
- Fake personas. Fabricated profiles and chat conversations can build trust over time.
The goal is the same as before, so the same warning signs apply. The message asks for something unusual, adds pressure, or bypasses the normal process.
Defences
No single tool stops social engineering, so defence is layered.
- Training and awareness, including simulated phishing exercises
- Email filtering and link checking to block known lures
- Multifactor authentication, which limits what a stolen password can do
- Verification procedures, such as calling back on a known number before moving money
- Clear reporting so staff can flag suspicious messages quickly
- Physical controls, such as badges and visitor checks
A request for money or credentials that adds urgency and skips the normal process should be verified through a separate trusted channel.
What to remember for the exam
Seven facts cover most questions on this topic.
- Social engineering targets people, not technology.
- Phishing is a broad lure, spear phishing is targeted, and whaling targets executives.
- Vishing uses voice calls and smishing uses text messages.
- Pretexting uses an invented story, and tailgating follows someone through a door.
- Generative AI improves the quality, scale and personalisation of lures.
- Voice cloning and deepfake video can impersonate known people.
- Training, multifactor authentication and verification procedures are the main defences.
Common mistakes
These four errors appear often.
Relying on spelling errors to spot phishing. AI written messages can be perfectly written.
Trusting a familiar voice or face. Cloned voices and deepfake video can imitate people you know.
Treating this as only an email problem. Calls, texts, social media and visitors are all used.
Thinking technical controls alone are enough. The victim's action is what lets the attack succeed.
Multifactor authentication reduces the damage of a stolen password, but attackers can still trick users into approving prompts they did not start.
Check yourself
Work through these three questions.
What is the difference between phishing and spear phishing?
Phishing is a broad message sent to many people. Spear phishing is aimed at one person or group using personal details.
How does generative AI help social engineering?
It writes fluent, personalised messages and can clone voices and fake video, which makes impersonation more convincing and cheaper to scale.
Which controls help defend against social engineering?
Training, email filtering, multifactor authentication and verification procedures such as calling back on a known number.
Topic 6 of 8 in Security Monitoring
Test yourself on Security Monitoring
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.