Topic starter
24/10/2026 8:52 pm
TL;DR: For Riot, social engineering still succeeds by exploiting trust, and the blog cites roughly 60% of breaches in 2026 as involving human error. Verification has to slow high-risk requests before credentials, money, or access change hands.
Editorial analysis by NHI Mgmt Group, based on content published by Riot: “3,000 Years Later, What Can The Odyssey Tell Us About the Birth of Social Engineering?”.
By the numbers:
- Roughly 60% of all data breaches in 2026 still involve an element of human error, according to Riot.
Key questions
Q: Why do deepfakes make social engineering more effective?
A: Deepfakes make social engineering more effective because they add sensory credibility to the usual pressure tactics.
Q: What signs show that phishing resilience is weak?
A: Frequent clicks, credential reuse after training, and inconsistent escalation on suspicious requests all indicate that people are still making security decisions under stress without reliable guardrails.
Q: What breaks when staff trust a convincing impersonation request?
A: The failure is not only a mistaken click.
Practitioner guidance
- Implement out-of-band verification for high-risk requests Require a second channel for payment, credential reset, and privileged approval requests whenever the request originates through email, voice, or video.
- Run deception-focused simulations Test how quickly staff recognise impersonation, urgent payment pressure, and executive spoofing, then measure where they fail before the transaction completes.
- Add approval friction to financial workflows Introduce mandatory callbacks, dual approval, and beneficiary validation for transfers and account changes that would be costly if manipulated.
Bottom line: Social engineering remains effective because it attacks the human decision to trust, not just the technical environment around it.
Glossary terms: Social Engineering, Deepfake-based impersonation, Human Identity Assurance, Access Friction
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
The decisive control in social engineering is trust verification, not just technical hardening. Organisations often frame phishing and impersonation as awareness problems, but the article shows they are governance problems because the attacker is targeting the decision to trust. If the story is convincing enough, even strong perimeter controls are irrelevant. Practitioners need to design identity checks that slow down and validate high-risk human decisions.
A question worth separating out:
Q: Should organisations rely on awareness training alone against impersonation?
A: No. Awareness helps only when it is paired with process controls that slow the attacker down, such as callbacks, dual approval, and identity verification for sensitive actions. If a single employee can still authorise a major action on the strength of a persuasive story, the control design is incomplete.
👉 Read our full editorial: Human error and deepfakes still outrun security walls
This post was modified 7 days ago by NHI Mgmt Group