Social engineering attacks: are your identity controls keeping up?

TL;DR: Social engineering still succeeds by exploiting trust, urgency and routine rather than novel exploits, according to Valimail, and the article ties that risk to phishing, pretexting, vishing and impersonation that can lead to financial loss, breaches and reputational damage. The real defence is stronger identity verification at the message, caller and access layers, not awareness alone.

Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “9 ways to protect yourself from social engineering attacks”.

Key questions

Q: What breaks when social engineering is not governed as an identity risk?

A: When social engineering is treated as a user problem only, attackers can still drive password resets, MFA re-enrolment, payment approvals, and privileged exceptions through legitimate workflows.

Q: Why do vishing and MFA fatigue still work against organisations with MFA?

A: They work because the attacker targets the human and the recovery process, not the MFA factor itself.

Q: How can security teams know whether social engineering defences are working?

A: Look for fewer successful impersonation attempts, fewer unauthorised resets, stronger reporting of suspicious requests and shorter time-to-containment when a deceptive message is reported.

Practitioner guidance

• Tighten help desk verification steps Require out-of-band confirmation, callback verification and step-up checks before any password reset, MFA reset or account recovery action.
• Harden email authentication controls Move domain authentication to enforced DMARC policies and monitor for spoofing patterns that could support phishing and brand impersonation.
• Reduce privilege on recovery and support roles Review who can approve identity changes, reset access or modify federation settings, then remove standing access that is not operationally necessary.

Bottom line: Social engineering succeeds when organisations allow trust to be converted into access faster than it can be verified.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →