Human error and deepfakes still outrun security walls

At a glance

What this is: This is an analysis of how social engineering, cover stories, and deepfake impersonation still defeat strong technical defences by exploiting trust and human decision-making.

Why it matters: It matters because identity and security programmes fail when people are the weakest control plane, so training, verification, and escalation paths must be designed around deception risk.

By the numbers:

• Roughly 60% of all data breaches in 2026 still involve an element of human error, according to Riot.

Context

The core problem is not that technical controls do nothing, but that attackers often bypass them by persuading people to act against the intended security process. Social engineering works because it targets judgment, trust, urgency, and authority, which means the security boundary is partly human and partly procedural.

That makes this a human identity governance problem as much as a security awareness problem. When an employee can be convinced to approve access, reveal credentials, or move money, the organisation has failed to control the decision point that matters most. The Trojan Horse remains useful because it describes a governance gap, not just a clever trick.

Key questions

Q: What breaks when staff trust a convincing impersonation request?

A: The failure is not only a mistaken click. Once a user trusts the story, they may disclose credentials, approve a transfer, or bypass normal checks, which turns social engineering into a business process failure. The right control is to make high-risk actions require independent verification before any commitment is accepted.

Q: Why do deepfakes make social engineering more effective?

A: Deepfakes make social engineering more effective because they add sensory credibility to the usual pressure tactics. A fake face or voice can create trust, authority, and urgency faster than text alone, which lowers the chance that people will pause and verify. That is why procedures must focus on request validation, not confidence in what is seen or heard.

Q: What signs show that phishing resilience is weak?

A: Frequent clicks, credential reuse after training, and inconsistent escalation on suspicious requests all indicate that people are still making security decisions under stress without reliable guardrails. The issue is not whether staff can repeat policy, but whether they can apply it when a request feels urgent or familiar.

Q: Should organisations rely on awareness training alone against impersonation?

A: No. Awareness helps only when it is paired with process controls that slow the attacker down, such as callbacks, dual approval, and identity verification for sensitive actions. If a single employee can still authorise a major action on the strength of a persuasive story, the control design is incomplete.

Technical breakdown

Why social engineering succeeds before technical controls engage

Social engineering succeeds when the attacker can shape the victim's interpretation of events before any security tool has a chance to intervene. The mechanism is persuasive framing: a believable reason, a familiar authority, and a false sense of urgency. In identity terms, the attacker does not break authentication first. They manipulate the human who is about to authenticate, approve, transfer, or disclose. That makes the initial decision point the real target, not the downstream system.

Practical implication: build controls that verify intent and authority before users disclose credentials or approve high-risk actions.

Deepfakes and AI impersonation amplify trust abuse

AI voice cloning and video deepfakes reduce the cost of impersonation and increase the realism of fabricated authority. The risk is not only that the content looks authentic, but that employees receive a live, interactive social cue that bypasses suspicion. This shifts social engineering from static phishing to real-time identity deception. In IAM terms, the problem is not only access control after authentication, but trust calibration before authentication and transaction approval.

Practical implication: require out-of-band verification for payment, reset, and privileged access requests when identity is asserted through voice or video.

Human error becomes a control dependency, not a side effect

When a breach path depends on someone clicking, approving, or disclosing, human error stops being a residual risk and becomes a control dependency. The article's 60% figure underlines that this remains structurally common, not exceptional. Organisations often overestimate the protection provided by network, endpoint, and identity controls if those controls can be overridden by a convincing story. The real weakness is untested decision-making under pressure.

Practical implication: treat human error as a measurable security control failure and test it through simulations, escalation drills, and approval friction.

Threat narrative

Attacker objective: The attacker aims to convert trust into authorisation so they can obtain credentials, trigger payment, or gain access without defeating technical defences directly.

1. Entry occurs when the attacker reaches the target through a believable story rather than a technical exploit, using social persuasion to gain attention and trust.
2. Credential access or authorisation follows when the victim clicks, shares secrets, or approves the action, handing over the equivalent of the keys to the city walls.
3. Impact is achieved when the attacker uses that misplaced trust to steal money, exfiltrate data, or extend access into downstream systems.

NHI Mgmt Group analysis

The decisive control in social engineering is trust verification, not just technical hardening. Organisations often frame phishing and impersonation as awareness problems, but the article shows they are governance problems because the attacker is targeting the decision to trust. If the story is convincing enough, even strong perimeter controls are irrelevant. Practitioners need to design identity checks that slow down and validate high-risk human decisions.

AI impersonation has turned social engineering into a scalable identity attack. Deepfakes compress the gap between fabricated authority and believable interaction, which means the old assumption that employees can reliably spot fraud is weakening. This is especially relevant to human identity and finance workflows, where voice and video are often treated as implicit proof. The practitioner lesson is to remove implicit trust from high-value approvals.

Human psychology is the ultimate firewall is a useful concept because it exposes the real failure mode: uncontrolled human decision-making under pressure. The article's history framing is effective because it shows that attackers do not need to defeat every layer if they can manipulate the person at the boundary. For security leaders, that means resilience depends on rehearsed skepticism, verification habits, and escalation paths that are hard to bypass.

Social engineering should be managed as a measurable control domain, not a periodic training topic. The persistent prevalence of human error shows that awareness alone is not enough if the organisation never tests whether people can resist a live lure. The relevant governance question is whether the business can detect, slow, and recover from deceptive requests before damage is done. That is a board-level assurance issue, not a one-off campaign.

The Trojan Horse remains current because the weakest point is still the human interface. Technical identity controls matter, but they do not eliminate the need for robust human verification when requests arrive through email, voice, or video. The modern control gap is not lack of tools, but lack of disciplined challenge at the moment of trust. Teams should treat every high-risk request as a potential impersonation event.

What this signals

Human error is no longer a background risk. When breaches depend on persuasion, the control point shifts from perimeter defence to decision integrity, which means organisations need to measure how people behave under deception rather than assume training has solved the problem.

AI impersonation is widening the trust gap. Voice and video deepfakes make it harder to distinguish routine business communication from a fraudulent request, so security programmes must build friction into the moments where authority is asserted and money or access can move.

The governance lesson is simple: verify intent before you verify access. If a request cannot survive callback, challenge, or dual approval, then it should not be treated as trustworthy enough to trigger a privileged action.

For practitioners

• Implement out-of-band verification for high-risk requests Require a second channel for payment, credential reset, and privileged approval requests whenever the request originates through email, voice, or video.
• Run deception-focused simulations Test how quickly staff recognise impersonation, urgent payment pressure, and executive spoofing, then measure where they fail before the transaction completes.
• Add approval friction to financial workflows Introduce mandatory callbacks, dual approval, and beneficiary validation for transfers and account changes that would be costly if manipulated.
• Train staff on AI impersonation patterns Teach employees to treat live video and voice as insufficient proof on their own, especially when the request bypasses normal process.

Key takeaways

• Social engineering remains effective because it attacks the human decision to trust, not just the technical environment around it.
• The article cites roughly 60% of breaches in 2026 as involving human error, which shows the scale of the problem has not diminished.
• The most effective response is to build verification, friction, and rehearsal into high-risk requests before credentials, money, or access change hands.

Key terms

• Social Engineering: Social engineering is the use of deception, urgency, and authority to persuade a person to reveal information or take a risky action. It targets human decision-making rather than software defects, and often turns legitimate identity workflows into the attack path.
• Deepfake-based impersonation: A fraud technique that uses synthetic audio, video, or both to make an attacker appear to be a trusted person during a live interaction. The tactic exploits human trust in familiar cues and often aims to trigger urgent actions such as payments, resets, or access changes before verification is challenged.
• Human Identity Assurance: Human identity assurance is the set of controls and signals used to verify that a person is who they claim to be and is behaving within expected boundaries. In phishing contexts, it extends beyond authentication to include decision-making, reporting behaviour, and resistance to deceptive requests.
• Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management through an identity-first lens. It helps security and IAM practitioners build stronger controls around trust, verification, and lifecycle risk.