Notifications
Clear all
Topic starter
02/08/2026 12:02 pm
TL;DR: Social engineering remains a dominant initial access path, with Verizon finding the human element involved in roughly three of every four breaches and the FBI logging $16.6 billion in cybercrime losses in 2024, including $2.77 billion from business email compromise, according to Torq’s source article. Manual validation, containment, and documentation create the delay attackers need; automation changes the economics of response more than it changes the lure itself.
NHIMG editorial — based on content published by torq: Social engineering response in the SOC
By the numbers:
- Business email compromise alone accounted for $2.77 billion across 21,442 reported incidents.
Questions worth separating out
Q: What breaks when social engineering response is still manual?
A: Manual response breaks because containment depends on analysts moving across multiple tools in sequence, which creates delay and inconsistency.
Q: Why do social engineering attacks become breach events so quickly?
A: They become breaches quickly because the first successful interaction often produces valid access, not just a suspicious email.
Q: What do security teams get wrong about phishing and BEC?
A: Teams often treat phishing and BEC as awareness issues instead of access-control failures.
Practitioner guidance
- Automate phishing-to-containment workflows Chain email quarantine, sender blocking, credential reset, session revocation, endpoint isolation, and ticket updates into a single response path so the SOC does not depend on manual handoffs.
- Treat help desk recovery as a security control Require stronger identity proofing for password resets, MFA re-enrolment, and account recovery so an impersonation call cannot become an access grant.
- Measure response latency as a core control Track the time from alert ingestion to credential reset, token revocation, and endpoint isolation, then use those metrics to identify which workflow step slows containment.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step SOC orchestration for phishing, BEC, and vishing cases across email, IAM, EDR, and case management tools.
- Workflow examples for credential resets, session revocation, mailbox quarantine, and endpoint isolation in a single response chain.
- Audit-log and compliance handling for automated containment decisions, including how to replay the case for review.
- Examples of high-volume incident handling where human judgment is reserved for escalation and fraud verification.
👉 Read torq's analysis of social engineering response automation in the SOC →
Social engineering response automation: are your controls keeping up?
Explore further
02/08/2026 1:08 pm
Manual response is the governance failure social engineering exploits. The article’s strongest signal is not about phishing volume but about the gap between detection and action. Security teams often assume that knowing about an incident is close enough to containing it, but social engineering turns that assumption into liability. When the first responder must jump between IAM, email, EDR, and ticketing tools, the attacker owns the clock. The practical conclusion is that response governance matters as much as detection quality.
A question worth separating out:
Q: Who is accountable when a social engineering attack reaches the IAM stack?
A: Accountability usually spans SOC, IAM, help desk, and business owners because the incident crosses detection, recovery, and access governance. If a reset process or approval workflow was easy to impersonate, that is a control design issue, not only an end-user failure. Governance should assign ownership for recovery paths, session controls, and response timing.
👉 Read our full editorial: Social engineering response gaps persist when SOC actions stay manual
