Manipulating people into breaking security practices, such as sharing passwords or granting access, rather than attacking technology directly.
Social engineering exploits human tendencies such as trust, helpfulness, fear, and urgency. Techniques include phishing emails, phone scams, impersonating staff or contractors, leaving infected USB drives for people to find, and following employees through secure doors, which is known as tailgating.
For example, an attacker might call a company's help desk pretending to be a stressed employee locked out before an important meeting, persuading the agent to reset the password without proper checks. Many major breaches begin this way, because a convincing story can bypass strong technical defenses. Reducing the risk involves regular training, clear verification procedures that staff are expected to follow even under pressure, a culture where questioning unusual requests is welcomed, and technical controls such as multi-factor authentication that limit the damage when someone is fooled.
A social engineering attack that uses fake emails, messages, or websites to trick people into revealing information or installing malware.
Security Awareness TrainingEducation that teaches employees to recognize and avoid cyber threats such as phishing, scams, and unsafe handling of data.
Spear PhishingA targeted phishing attack aimed at a specific person or organization, using personal details to make the message more convincing.
Passkeys replace passwords with phishing-resistant cryptography built into your devices. Here is how they work, how to start using them, and how businesses can roll them out.
How ransomware gets into small businesses, the prevention controls that matter most, how to set up 3-2-1 backups, and what to do in the first hours of an attack, based on CISA guidance.
What PCI DSS means for small merchants: merchant levels, which SAQ fits your setup, and how your payment processor can shrink your compliance scope.