Social engineering attack chains: what does unified defense change?

TL;DR: Social engineering now blends deepfakes, vishing, help desk impersonation, and infrastructure pivots fast enough to outpace siloed controls, according to Doppel's IDC Spotlight, which argues for unifying digital risk protection, email security, and human risk management. The governing problem is not message volume alone, but the attacker’s ability to move across channels and takedown surfaces faster than fragmented teams can coordinate.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “IDC Spotlight, sponsored by Doppel, From Infrastructure to Inbox: Defending the Full Social Engineering Attack Chain”.

By the numbers:

• Social engineering accounts for up to 24% of ransomware incidents, according to Doppel.
• The FBI reports $17.7B in cyber-enabled fraud losses in 2025, with much of it coming from social engineering tactics, according to Doppel.

Key questions

Q: How should security teams defend against social engineering that spans email, voice, and deepfakes?

A: Treat the attack as one campaign across multiple channels.

Q: Why do deepfakes create more risk than ordinary phishing emails?

A: Deepfakes add credible audio or video to the social engineering attack, which removes many of the visual and linguistic cues people use to detect fraud.

Q: What do teams get wrong when they treat social engineering as a human-awareness problem?

A: They over-focus on training and under-invest in operational controls.

Practitioner guidance

• Define a campaign-level response model Map social engineering as a single chain across email, voice, web, and human response, then assign one owner for correlation and escalation.
• Add high-risk verification steps Require out-of-band callbacks, secondary approvers, or challenge questions for payment, reset, and privileged requests that could be spoofed by deepfake or vishing attacks.
• Correlate digital risk and inbox signals Join reported phish, impersonation domains, and brand abuse indicators so takedowns and blocking actions can target the full campaign infrastructure.

Bottom line: Social engineering is no longer a single-message problem because attackers can chain reconnaissance, impersonation, delivery, and fraud across multiple control planes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →