Topic starter
24/10/2026 8:49 pm
TL;DR: Social engineering now works because AI cut attacker costs and made believable deception easier to repeat, according to Doppel. Recovery, approval, and privileged workflows become the main pressure points when verification stays more expensive than attack.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Why Social Engineering Works: The Adversary Economics Behind the Attack”.
By the numbers:
- The median time to click a lure was 21 seconds, according to the 2025 Verizon DBIR cited by Doppel.
Key questions
Q: Why do social engineering attacks still succeed in well-defended organisations?
A: They succeed because attackers target human judgement, not just technical weaknesses.
A: Common warning signs include unusual login behaviour, out-of-hours data movement, abnormal LDAP query volumes, new privileged accounts, suspicious internal traffic, and employees receiving urgent requests that bypass normal process.
Q: What breaks when social engineering is not governed as an identity risk?
A: When social engineering is treated as a user problem only, attackers can still drive password resets, MFA re-enrolment, payment approvals, and privileged exceptions through legitimate workflows.
Practitioner guidance
- Harden account recovery paths Require stronger identity verification for password resets, MFA re-enrolment, and help desk overrides so attackers cannot turn a conversation into access.
- Disrupt reused attacker infrastructure Continuously hunt for lookalike domains, recycled phone numbers, cloned brand assets, and staged personas before they are used in a campaign.
- Add friction to privileged approvals Separate payment, access, and recovery approvals from the channel used for the initial request so a single conversation cannot complete the workflow.
Bottom line: Social engineering succeeds when attackers can make deception cheaper than defenders can verify and respond.
Glossary terms: Social Engineering, Deception Economics, Account Recovery, Identity Workflow Automation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Social engineering is now an identity governance problem, not only a human behaviour problem. The article is right to move the discussion away from awareness alone, because many attack outcomes depend on a human being allowed to change identity state, approve access, or authorise recovery. Once an attacker can influence those moments, the control failure is not just user judgement, it is governance over trust decisions. Practitioners should treat social engineering as a test of identity workflows and escalation paths.
A question worth separating out:
A: They should treat help desk authentication and account recovery as high-risk identity controls, not routine service tasks. Use strong identity verification, separate approval paths for sensitive changes, and monitoring for unusual reset or recovery activity. These workflows are attractive because an attacker who persuades support staff can reset credentials or authentication methods without ever exploiting a technical vulnerability.
👉 Read our full editorial: Social engineering succeeds because its economics now favor attackers
This post was modified 6 days ago by NHI Mgmt Group