TL;DR: Social engineering now blends deepfakes, vishing, help desk impersonation, and infrastructure pivots fast enough to outpace siloed controls, according to Doppel's IDC Spotlight, which argues for unifying digital risk protection, email security, and human risk management. The governing problem is not message volume alone, but the attacker’s ability to move across channels and takedown surfaces faster than fragmented teams can coordinate.
At a glance
What this is: Doppel's IDC Spotlight argues that social engineering now operates as a chained campaign across infrastructure, email, and people rather than a single-message problem.
Why it matters: IAM, NHI, and security teams need to treat impersonation, inbox compromise, and human decision-making as one control surface because fragmented ownership leaves gaps attackers can exploit.
By the numbers:
- Social engineering accounts for up to 24% of ransomware incidents, according to Doppel.
- The FBI reports $17.7B in cyber-enabled fraud losses in 2025, with much of it coming from social engineering tactics, according to Doppel.
Context
Social engineering is an attack chain, not a single event: reconnaissance, impersonation, message delivery, and follow-on fraud or compromise often happen across separate tools and teams. Deepfakes, social engineering and AI impersonation now accelerate that chain by making trusted voices and familiar workflows easier to counterfeit.
The governance gap is coordination. Email security, digital risk protection, and human risk programmes are usually operated as parallel controls, yet attackers move fluidly between them. That makes the starting assumption of many control stacks, that one channel can be defended independently, increasingly outdated.
Key questions
Q: How should security teams defend against social engineering that spans email, voice, and deepfakes?
A: Treat the attack as one campaign across multiple channels. Correlate mail, brand, voice, and fraud signals, require out-of-band verification for high-risk requests, and measure whether your team can remove the underlying infrastructure, not just the visible lure.
Q: Why do deepfakes create more risk than ordinary phishing emails?
A: Deepfakes add credible audio or video to the social engineering attack, which removes many of the visual and linguistic cues people use to detect fraud. That makes the victim more likely to act quickly, especially when the request appears to come from a senior leader or known colleague.
Q: What do teams get wrong when they treat social engineering as a human-awareness problem?
A: They over-focus on training and under-invest in operational controls. Awareness helps, but the decisive control is whether the organisation can verify identity claims, escalate suspicious requests, and disrupt the campaign infrastructure quickly enough.
A: Blocking a message stops one delivery event. Dismantling a campaign removes the domains, accounts, redirects, and impersonation assets that let the same operator keep reusing the attack across victims and channels.
Technical breakdown
How social engineering chains move from reconnaissance to action
Modern social engineering campaigns are staged operations. Reconnaissance identifies targets, impersonation establishes trust, delivery routes the lure through email, messaging, or voice, and the final step exploits a human or process decision. AI compresses each stage, especially reconnaissance and content generation, so the attacker can test variants and pivot channels quickly. The security issue is not only whether a message is blocked, but whether the organisation can see the broader campaign infrastructure, correlate signals across channels, and remove the operation before it reappears in a new form. See the Email Security Guide.
Practical implication: Treat social engineering as a campaign lifecycle and correlate email, web, voice, and brand abuse signals in one workflow.
Why deepfakes and impersonation defeat channel-only controls
Deepfakes alter the trust model by making voice and video look like reliable identity proof when they are not. A help desk agent, finance approver, or executive may respond to a convincing impersonation even when mailbox filters and domain controls are intact. This is why channel security alone is insufficient: the attacker is exploiting human verification shortcuts, not only message transport. The control problem moves from content inspection to identity-based verification, escalation discipline, and challenge-response checks that do not depend on the appearance of authenticity. See the Security Awareness and Human Risk Management Guide.
Practical implication: Add out-of-band verification and payment or privilege challenge steps wherever identity claims can trigger action.
What it means to dismantle attacker infrastructure rather than chase messages
Traditional takedown workflows often start with an individual phish or fraudulent site, but social engineering operators reuse the same infrastructure across many messages and victims. If defenders only delete the visible lure, the underlying sender, domain, hosting, or redirection chain can remain active. Dismantling infrastructure means identifying and removing the campaign components that enable reuse, including domains, redirects, impersonation assets, and associated accounts. That shifts defence from reactive cleanup to suppressing the attacker’s operational capacity.
Practical implication: Prioritise infrastructure-level disruption so one campaign can be suppressed across all of its delivery paths.
Threat narrative
Attacker objective: The attacker wants to convert human trust into fraudulent transfers, unauthorized access, or campaign persistence across multiple channels.
- Entry begins with automated reconnaissance that collects brand, employee, and workflow details used to shape convincing lures.
- Credential or trust compromise follows when deepfakes, vishing, or help desk impersonation persuade a target to approve an action or reveal access.
- Escalation occurs as the attacker pivots from the initial interaction to infrastructure, inbox, or payment compromise, often using the same campaign assets repeatedly.
- Impact is fraud, ransomware enablement, or broader business compromise driven by a social engineering chain that outpaces fragmented defence.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Social engineering has become a multi-control-plane problem, not a content-filtering problem. The article's core value is that it frames the attack as a chain spanning digital risk, email, and human behaviour. That matters because each control plane usually has its own tools, owners, and escalation paths, which gives attackers room to move between them. Practitioners should stop evaluating these controls as separate buys and instead measure whether they can jointly interrupt the same campaign.
Deepfakes are not merely a more convincing lure; they are a trust system exploit. Voice and video impersonation short-circuit the shortcuts people use when they believe they are speaking to a known executive, coworker, or support agent. That shifts governance from detection of suspicious content to verification of identity claims, approved callback routes, and exception handling for high-risk requests. Teams that still treat authenticity as a channel property will miss the real failure mode.
Campaign disruption is the right operating model for social engineering defence. The useful objective is to dismantle the infrastructure that lets a lure keep resurfacing, not to score wins on isolated messages. That is especially relevant where AI can regenerate variants at speed and where reported phish feed takedown, training, and blocking workflows. Security leaders should build for campaign suppression, not just incident cleanup.
The identity intersection is now unavoidable because impersonation targets human and non-human trust boundaries alike. When deepfakes or cloned voices can trigger approval, reset, or payment workflows, the issue becomes governance of authentication assumptions across deepfake impersonation controls and broader identity processes. That means security teams need to think about who or what is trusted to initiate action, not only which message is delivered. The practitioner takeaway is to anchor verification in process, not appearance.
Social engineering generates governance debt when ownership is split across teams. Email, brand protection, fraud, and awareness functions often optimise for their own metrics while attackers exploit the seams between them. A single platform is not the only answer, but a single operating model is increasingly necessary if escalation paths, takedowns, and human interventions are to converge fast enough. Practitioners should align ownership around campaign interruption, not tool boundaries.
What this signals
Campaign suppression is becoming the decisive control for social engineering. Organisations that only remove individual lures will keep facing regenerated variants, reused hosting, and repeated impersonation attempts. The operating question is whether defenders can interrupt the full attack chain before the next message, callback, or fraudulent transfer lands.
Identity verification now needs to survive synthetic media. Deepfake-driven impersonation has made appearance-based trust an unreliable signal for approval, reset, and payment workflows. Security programmes should treat callback discipline, exception handling, and role-based verification as core controls rather than process overhead.
For practitioners
- Define a campaign-level response model Map social engineering as a single chain across email, voice, web, and human response, then assign one owner for correlation and escalation.
- Add high-risk verification steps Require out-of-band callbacks, secondary approvers, or challenge questions for payment, reset, and privileged requests that could be spoofed by deepfake or vishing attacks.
- Correlate digital risk and inbox signals Join reported phish, impersonation domains, and brand abuse indicators so takedowns and blocking actions can target the full campaign infrastructure.
- Measure takedown and repeat-attack suppression Track how quickly your team removes reused domains, sender assets, and impersonation pages, not just how many messages are blocked.
Key takeaways
- Social engineering is no longer a single-message problem because attackers can chain reconnaissance, impersonation, delivery, and fraud across multiple control planes.
- The article cites up to 24% of ransomware incidents and $17.7B in cyber-enabled fraud losses in 2025, underscoring the scale of the threat.
- The practical response is to verify identity out of band, correlate signals across channels, and suppress the campaign infrastructure rather than only blocking one lure.
Related NHI Mgmt Group resources: Deepfakes, Social Engineering and AI Impersonation Guide · Security Awareness and Human Risk Management Guide · Email Security Guide · Dark Web Monitoring Buyer's Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Deepfake impersonation and social engineering exploit human trust boundaries around identity claims. |
| Recommendation — Separate human verification from channel trust and require independent checks before approving sensitive actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Social engineering often succeeds by inducing unauthorized approval or access changes. |
| DE.CM-01 — Monitoring for Abnormal Activities | Campaign-level detection depends on correlating repeated impersonation and infrastructure abuse signals. | |
| Recommendation — Restrict sensitive approvals and resets so identity claims alone cannot create or change access. Correlate mail, web, and fraud signals to detect reused campaign infrastructure faster. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Cross-channel social engineering defence needs evidence from multiple systems to link related activity. |
| Recommendation — Centralize logs from email, domain, and fraud workflows to reconstruct the full attack chain. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes impersonation-driven access and follow-on pivoting across systems. |
| Recommendation — Map impersonation-driven activity to credential access and lateral movement to improve detection and response. | ||
Key terms
- Social Engineering Attack Surface: The social engineering attack surface is the people-based exposure created when attackers manipulate employees into revealing information, approving access, or clicking malicious content. It is a human risk domain, not a technical flaw, and it becomes more dangerous when identity, privilege, and behaviour signals are not analysed together.
- Deepfake-based impersonation: A fraud technique that uses synthetic audio, video, or both to make an attacker appear to be a trusted person during a live interaction. The tactic exploits human trust in familiar cues and often aims to trigger urgent actions such as payments, resets, or access changes before verification is challenged.
- Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
- Digital Risk Protection: Digital risk protection is the practice of monitoring external channels for threats that target an organisation’s brand, people, domains, and online presence. It focuses on impersonation, credential exposure, rogue apps, and related abuse so security teams can detect and respond before those signals become active incidents.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org