Topic starter
25/10/2026 10:59 am
TL;DR: Social engineering now works as a chained campaign across email, voice, deepfakes, and fraud, according to Doppel's IDC Spotlight. Verification and takedown work need to span the whole attack path, not just one lure.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “IDC Spotlight, sponsored by Doppel, From Infrastructure to Inbox: Defending the Full Social Engineering Attack Chain”.
By the numbers:
- Social engineering accounts for up to 24% of ransomware incidents, according to Doppel.
- The FBI reports $17.7B in cyber-enabled fraud losses in 2025, with much of it coming from social engineering tactics, according to Doppel.
Key questions
Q: Why do deepfakes create more risk than ordinary phishing emails?
A: Deepfakes add credible audio or video to the social engineering attack, which removes many of the visual and linguistic cues people use to detect fraud.
Q: What do teams get wrong when they treat social engineering as a human-awareness problem?
A: They over-focus on training and under-invest in operational controls.
Q: How should security teams defend against social engineering that spans email, voice, and deepfakes?
A: Treat the attack as one campaign across multiple channels.
Practitioner guidance
- Define a campaign-level response model Map social engineering as a single chain across email, voice, web, and human response, then assign one owner for correlation and escalation.
- Add high-risk verification steps Require out-of-band callbacks, secondary approvers, or challenge questions for payment, reset, and privileged requests that could be spoofed by deepfake or vishing attacks.
- Correlate digital risk and inbox signals Join reported phish, impersonation domains, and brand abuse indicators so takedowns and blocking actions can target the full campaign infrastructure.
Bottom line: Social engineering is no longer a single-message problem because attackers can chain reconnaissance, impersonation, delivery, and fraud across multiple control planes.
Glossary terms: Social Engineering Attack Surface, Deepfake-based impersonation, Human Risk Management, Digital Risk Protection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Social engineering has become a multi-control-plane problem, not a content-filtering problem. The article's core value is that it frames the attack as a chain spanning digital risk, email, and human behaviour. That matters because each control plane usually has its own tools, owners, and escalation paths, which gives attackers room to move between them. Practitioners should stop evaluating these controls as separate buys and instead measure whether they can jointly interrupt the same campaign.
A question worth separating out:
A: Blocking a message stops one delivery event. Dismantling a campaign removes the domains, accounts, redirects, and impersonation assets that let the same operator keep reusing the attack across victims and channels.
👉 Read our full editorial: Defending the full social engineering attack chain requires unified controls
This post was modified 7 days ago by NHI Mgmt Group