Topic starter
21/10/2026 2:46 pm
TL;DR: Employee-targeted attacks now combine public-profile research, voice calls and follow-up texts because urgency makes the request feel familiar, according to Adaptive Security. Verification has to interrupt the channel sequence before trust turns into action.
Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Cybersecurity Awareness Month Hits the Midpoint, and Adaptive’s Free Toolkit Is Keeping Pace”.
Key questions
Q: Why do public profiles make impersonation attacks more effective?
A: Because attackers can borrow details that make a request sound internal, timely, and informed.
Q: What are the signs that social engineering controls are failing?
A: Common failure signals include repeated clicks on suspicious links, staff bypassing verification steps, unexpected credential sharing, and approval of urgent requests through unapproved channels.
A: Treat it as a verification problem, not a spam problem.
Practitioner guidance
- Implement out-of-band verification for sensitive requests Require a second, independent channel before approving payment, access, or exception requests that arrive by phone, text, or direct message.
- Reduce public profile exposure Review employee social profiles and public-facing team pages for details that help attackers impersonate internal roles, reporting lines, or current work.
- Adopt a shared passcode for high-risk requests Use one agreed verification phrase or passcode for requests involving money, access, or urgent exceptions, and train staff to refuse action without it.
Bottom line: The article shows that modern social engineering works by combining public research, urgent messaging, and voice or text impersonation, not by sending one suspicious email.
Glossary terms: Social Proof Chaining, Out-Of-Band Verification, Public Profile Exposure, Human Risk Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
23/10/2026 12:48 am
Multi-channel social engineering is now a trust-engineering problem: The core failure is no longer one bad email, but a request sequence that borrows trust from multiple channels. Training that treats email, voice, and text as separate problems misses how attackers blend them into one social proof loop. Practitioners need to treat verification design as a control plane for human trust, not a reminder campaign.
A question worth separating out:
Q: What should teams do when a request feels urgent but unverified?
A: Pause, verify through a trusted channel, and refuse to act until the request is confirmed independently. Urgency is the attacker’s pressure tool, so the correct response is to slow the workflow rather than escalate it. Organisations should make this the default behaviour for money, access, and executive-support requests, not an exception reserved for obvious scams.
👉 Read our full editorial: Social engineering now spans voice, text and profile research
This post was modified 3 days ago by NHI Mgmt Group