Topic starter
06/11/2026 6:39 pm
TL;DR: Nearly 60% of breaches now involve a human element, yet fewer than a third start in email, while the average breach has climbed to $4.4 million, according to imper.ai's analysis of recent breach data and industry reporting. Email-only phishing controls are no longer enough when attackers exploit trust across chat, voice and collaboration tools.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “Phishing has moved on. Have your defenses?”.
By the numbers:
- Nearly 60% of breaches now involve a human element.
- Third-party and supply-chain-related breaches now account for 30% of incidents.
Key questions
Q: How should teams verify work requests in collaboration tools?
A: Teams should verify collaboration requests by checking the requester’s identity through a separate trusted channel, confirming the requested action against known workflows, and requiring step-up verification for payments, credential resets, data exports, or access changes.
Q: Why do attackers prefer chat and voice over email for impersonation?
A: Attackers prefer chat and voice because they feel immediate, conversational and lower friction than email, which helps them pressure targets before suspicion rises.
Q: What are the first signs of a multi-channel impersonation attempt?
A: The first signs are a request that arrives through one channel and is quickly reinforced by another, a sense of urgency, and a mismatch between the requester’s normal behaviour and the action asked for.
Practitioner guidance
- Expand trust controls beyond email Apply verification steps to chat, voice and video requests that can trigger password resets, payment changes or privileged access.
- Review help desk escalation paths Require stronger challenge and callback procedures for requests that appear to come from executives, managers or internal support staff.
- Instrument collaboration channels for risk signals Correlate device fingerprint, network location and behavioural consistency so suspicious interactions can be paused before action is taken.
Bottom line: Social engineering now reaches employees through collaboration tools and voice, so email-centric controls only cover part of the attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Trust has become the primary security object in modern social engineering. Email content remains relevant, but the stronger signal now sits in the interaction itself, where identity, timing and context can be manipulated across multiple channels. That makes social engineering a governance problem for IAM, help desk operations and fraud teams, not just an awareness problem. Practitioners should treat trust validation as a control plane, not a user education slogan.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How can organisations protect the help desk from social engineering attacks?
A: Protect the help desk by requiring stronger identity verification for password resets, MFA changes, and account recovery. Use call-backs, out-of-band approval, and scripted checks for high-risk requests. Train staff to recognise urgency, authority, and pretexting, and monitor for repeated attempts against the same users or accounts.
👉 Read our full editorial: Multi-channel impersonation is outpacing email-centric defence