Social engineering across channels: are your controls keeping up?

TL;DR: Employee-targeted attacks now blend public-profile research, voice calls, and follow-up texts to create urgency, showing that modern social engineering is no longer a single phishing message but a coordinated multi-channel manipulation pattern, according to Adaptive Security. The control problem is moving from email filtering to trust verification, because the attack often succeeds before any security tooling can intervene.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Cybersecurity Awareness Month Hits the Midpoint, and Adaptive’s Free Toolkit Is Keeping Pace”.

Key questions

Q: How should organisations handle social engineering that uses voice, text, and profile research together?

A: Treat it as a verification problem, not a spam problem.

Q: Why do public profiles make impersonation attacks more effective?

A: Because attackers can borrow details that make a request sound internal, timely, and informed.

Q: What are the signs that social engineering controls are failing?

A: Common failure signals include repeated clicks on suspicious links, staff bypassing verification steps, unexpected credential sharing, and approval of urgent requests through unapproved channels.

Practitioner guidance

• Implement out-of-band verification for sensitive requests Require a second, independent channel before approving payment, access, or exception requests that arrive by phone, text, or direct message.
• Reduce public profile exposure Review employee social profiles and public-facing team pages for details that help attackers impersonate internal roles, reporting lines, or current work.
• Adopt a shared passcode for high-risk requests Use one agreed verification phrase or passcode for requests involving money, access, or urgent exceptions, and train staff to refuse action without it.

Bottom line: The article shows that modern social engineering works by combining public research, urgent messaging, and voice or text impersonation, not by sending one suspicious email.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →