Social engineering succeeds because its economics now favor attackers

At a glance

What this is: Doppel frames social engineering as an attacker economics problem, arguing that AI and reusable deception infrastructure have made the human path into organisations cheaper than technical intrusion.

Why it matters: IAM, PAM, NHI, and fraud teams should treat social engineering as a control-bypass business model that shifts risk from software exploits to identity trust, response latency, and misuse of access-bearing accounts.

By the numbers:

• The median time to click a lure was 21 seconds, according to the 2025 Verizon DBIR cited by Doppel.

Context

Social engineering is often discussed as a user-training problem, but the article treats it as a governance and economics problem instead. When deception becomes cheaper to produce than technical intrusion is to defend, the security boundary shifts from exploit prevention to trust management, identity validation, and response speed. That is especially relevant where humans can approve access, reset credentials, or authorise payments.

The identity connection is direct: a convincing message, impersonation, or live conversation can trigger account recovery, token issuance, MFA fatigue, or privileged workflow approval. In that sense, social engineering is not separate from IAM and PAM, it is a pressure test of the assumptions those programmes make about who is asking, what they are allowed to do, and how quickly the organisation can verify intent.

Key questions

Q: What breaks when social engineering is not governed as an identity risk?

A: When social engineering is treated as a user problem only, attackers can still drive password resets, MFA re-enrolment, payment approvals, and privileged exceptions through legitimate workflows. The failure is that identity state changes are often trusted too readily. Governance has to cover the moments where a person can trigger access, not just the inbox that delivered the lure.

Q: Why do social engineering attacks still succeed in well-defended organisations?

A: They succeed because attackers target human judgement, not just technical weaknesses. Even strong email filters and endpoint controls cannot stop a convincing pretext delivered through a trusted channel. Once the victim complies, the attack often shifts into identity abuse, where credentials, approvals, or access workflows are the real prize.

Q: What are the signs that a social engineering campaign is actively progressing inside an organisation?

A: Common warning signs include unusual login behaviour, out-of-hours data movement, abnormal LDAP query volumes, new privileged accounts, suspicious internal traffic, and employees receiving urgent requests that bypass normal process. Another signal is slow exfiltration that blends into ordinary traffic, especially when activity appears legitimate on the surface but does not fit the user’s normal pattern.

Q: What should organisations do when social engineering targets help desk or account recovery workflows?

A: They should treat help desk authentication and account recovery as high-risk identity controls, not routine service tasks. Use strong identity verification, separate approval paths for sensitive changes, and monitoring for unusual reset or recovery activity. These workflows are attractive because an attacker who persuades support staff can reset credentials or authentication methods without ever exploiting a technical vulnerability.

Technical breakdown

Why attacker economics now favour social engineering

Social engineering scales because the marginal cost of another attempt is close to zero while the payoff from one successful compromise can be very high. The article’s core point is that technical intrusion became harder through patching, EDR, segmentation, and MFA, so attackers rationally moved to the cheaper human path. AI then compressed research, persona creation, language localisation, and variant generation into seconds, which means volume rose without a matching rise in attacker labour. The business model is now industrialised deception, not artisanal fraud.

Practical implication: treat social engineering as a scale problem, not a one-off awareness problem, and target the reusable infrastructure that makes repeated campaigns cheap.

Why live conversations outperform static lures

A static lure is a one-shot bet, but a live conversation lets the attacker adapt in real time. That changes the conversion model because the adversary can respond to objections, sustain rapport, and shape the target’s next action as the exchange develops. It also degrades many automated filters, because the payload is not a single malicious artefact but a sequence of legitimate-looking messages, calls, or prompts. From a defensive standpoint, this is where identity trust and behavioural validation matter more than content inspection alone.

Practical implication: reinforce approval, recovery, and payment steps with context checks that survive an adaptive dialogue, not just message-scanning controls.

Why defender cost rises faster than attacker cost

The defender usually inherits the fragmented aftermath of one campaign across multiple teams and tools, including email security, fraud, IAM, SOC, and help desk. That means one attack becomes many investigations, each with its own queue, artifact set, and remediation step. The attacker, by contrast, automates campaign generation and reuses domains, personas, phone numbers, and brand assets. This asymmetry explains why awareness alone does not change outcomes. The control failure is not just human error, but the organisation’s inability to raise attacker cost before the lure spreads.

Practical implication: build cross-functional disruption workflows that remove attacker reuse opportunities before the campaign can scale.

Threat narrative

Attacker objective: The attacker wants to convert a cheap deception attempt into a high-value compromise by exploiting human trust as a scalable access path.

1. Entry begins with a believable message, impersonation, or live conversation that reaches a user with access to credentials, payments, or recovery workflows.
2. Credential access or trust abuse follows when the target authorises access, shares information, resets a password, or approves a transaction under pressure.
3. Impact occurs when the attacker converts that trust into account takeover, financial loss, or a broader intrusion path that bypasses technical controls.

Breaches seen in the wild

• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Social engineering is now an identity governance problem, not only a human behaviour problem. The article is right to move the discussion away from awareness alone, because many attack outcomes depend on a human being allowed to change identity state, approve access, or authorise recovery. Once an attacker can influence those moments, the control failure is not just user judgement, it is governance over trust decisions. Practitioners should treat social engineering as a test of identity workflows and escalation paths.

The named concept here is deception economics. That is the attacker’s ability to lower the cost of campaign creation faster than defenders can lower the cost of verification and response. AI accelerates content production, localisation, and persona creation, while defenders still pay for triage, escalation, and cleanup. The practical conclusion is that organisations need to measure the economics of abuse, not only the volume of attempts.

Human-facing controls only work when they are paired with system-level friction on reuse. The article’s strongest point is that the attacker’s edge comes from reusable infrastructure such as domains, phone numbers, branded assets, and identity pretexts. If those assets can be rebuilt cheaply, detection arrives after the money has moved. Security teams should focus on disrupting the repeatable parts of the attack chain, because that is where margins are made.

The boundary between social engineering and IAM is collapsing in practice. Phishing, vishing, and impersonation increasingly target MFA, account recovery, privileged approvals, and support desks rather than just inboxes. That means identity teams cannot outsource this problem to awareness campaigns or SOC detections alone. The programme response has to include recovery hardening, stronger verification for identity changes, and tighter governance over privileged human-mediated actions.

What this signals

Deception economics is the control problem here: attackers win when campaign creation becomes cheaper faster than verification and response. That means the reader’s programme has to focus on the reusable infrastructure behind impersonation, not only on end-user vigilance.

When social engineering reaches recovery, payment, or privileged approval paths, it becomes an identity workflow failure as much as a fraud problem. Security teams should expect attackers to target the least instrumented human-mediated decision points first.

The practical signal to watch is campaign reuse. If the same domains, phone numbers, brand assets, or pretexts keep returning, the organisation is facing a scalable operation rather than an isolated attempt.

For practitioners

• Harden account recovery paths Require stronger identity verification for password resets, MFA re-enrolment, and help desk overrides so attackers cannot turn a conversation into access.
• Disrupt reused attacker infrastructure Continuously hunt for lookalike domains, recycled phone numbers, cloned brand assets, and staged personas before they are used in a campaign.
• Add friction to privileged approvals Separate payment, access, and recovery approvals from the channel used for the initial request so a single conversation cannot complete the workflow.
• Measure social engineering as a business process Track time to detect, time to contain, and reappearance of reused assets so you can see whether the attacker’s campaign economics are being disrupted.

Key takeaways

• Social engineering succeeds when attackers can make deception cheaper than defenders can verify and respond.
• AI reduces the labour needed to create believable lures, localise them, and repeat them at scale.
• The strongest controls are the ones that make reuse expensive, especially in recovery, approval, and privileged workflows.

Key terms

• Social Engineering: Social engineering is the use of deception, urgency, and authority to persuade a person to reveal information or take a risky action. It targets human decision-making rather than software defects, and often turns legitimate identity workflows into the attack path.
• Deception Economics: Deception economics is the cost structure behind social engineering campaigns, including production cost, conversion rate, reuse, and failure cost. When those inputs become cheap for attackers and expensive for defenders, the attacker can scale abuse faster than teams can contain it.
• Account Recovery: Account recovery is the process used to restore access when a user cannot authenticate normally. In mature IAM programmes, recovery is treated as part of the trust chain because a weak reset path can bypass stronger login controls and become the easiest route to account takeover.
• Identity Workflow Automation: Identity workflow automation uses governed triggers and integrations to handle identity-related tasks such as provisioning, notifications, and record updates. The value is speed, but the control requirement is stronger: teams need logging, ownership, and lifecycle checks so automation does not spread inconsistency.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the operational risks that shape access, trust, and response.