Social engineering economics: what can security teams do now?

TL;DR: Social engineering has become the most cost-effective path into many companies because AI lowered attacker production costs, real-time conversations improved conversion, and defenders still absorb the higher cost of triage and response, according to Doppel. The result is an industrialized deception model that security teams have to disrupt at the infrastructure layer, not just at the user-awareness layer.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Why Social Engineering Works: The Adversary Economics Behind the Attack”.

By the numbers:

• The median time to click a lure was 21 seconds, according to the 2025 Verizon DBIR cited by Doppel.

Key questions

Q: What breaks when social engineering is not governed as an identity risk?

A: When social engineering is treated as a user problem only, attackers can still drive password resets, MFA re-enrolment, payment approvals, and privileged exceptions through legitimate workflows.

Q: Why do social engineering attacks still succeed in well-defended organisations?

A: They succeed because attackers target human judgement, not just technical weaknesses.

Q: What are the signs that a social engineering campaign is actively progressing inside an organisation?

A: Common warning signs include unusual login behaviour, out-of-hours data movement, abnormal LDAP query volumes, new privileged accounts, suspicious internal traffic, and employees receiving urgent requests that bypass normal process.

Practitioner guidance

• Harden account recovery paths Require stronger identity verification for password resets, MFA re-enrolment, and help desk overrides so attackers cannot turn a conversation into access.
• Disrupt reused attacker infrastructure Continuously hunt for lookalike domains, recycled phone numbers, cloned brand assets, and staged personas before they are used in a campaign.
• Add friction to privileged approvals Separate payment, access, and recovery approvals from the channel used for the initial request so a single conversation cannot complete the workflow.

Bottom line: Social engineering succeeds when attackers can make deception cheaper than defenders can verify and respond.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →