What do organisations get wrong when they rely on awareness training alone to stop social engineering?

Why This Matters for Security Teams

Awareness training is useful, but it is a weak control when attackers already have convincing context, stolen identities, and a short window to act. social engineering succeeds because it targets human judgment under pressure, then exploits gaps in verification, escalation paths, and privilege boundaries. NIST SP 800-53 Rev 5 Security and Privacy Controls treats awareness as only one layer of defense, not a substitute for process control, monitoring, or access restraint.

NHIMG research on the MGM Resorts Breach 2023 — Scattered Spider shows how a single successful social engineering event can bypass broad trust assumptions and trigger downstream compromise. Similar patterns appear in the Storm-2949 Azure Breach, where identity manipulation became the entry point rather than malware or technical exploitation.

In practice, many security teams discover that training did not fail because employees forgot the lesson, but because the organisation gave attackers a process they could still talk their way through.

How It Works in Practice

Effective anti-social-engineering programmes pair training with controls that force verification at the point of risk. The goal is to make a convincing request insufficient on its own. A user may recognise a suspicious call or message, but the organisation must also require out-of-band confirmation, approval segregation, and tightly scoped access before sensitive actions can happen. Current guidance from NIST SP 800-63 Digital Identity Guidelines reinforces that identity proofing and authentication need operational support, not just user vigilance.

In practice, teams should design for the failure of attention:

• Use step-up verification for password resets, MFA recovery, vendor bank changes, and privilege grants.
• Separate request, approval, and execution roles so one deceived employee cannot complete the full transaction.
• Limit standing privilege so a compromised account cannot act broadly after a single successful pretext.
• Monitor for unusual timing, geography, device changes, and repeated requests that fit known pretext patterns.
• Treat training as a reporting aid, so staff know how to escalate suspicious requests fast.

NHIMG analysis in the Caesars Entertainment Breach 2023 — Scattered Spider highlights how identity abuse often succeeds when process owners rely on verbal assurance instead of hard validation. The same lesson is echoed in the State of Secrets in AppSec, where exposed secrets and delayed remediation widen the blast radius after a user or service account is manipulated. These controls tend to break down when recovery desks, finance approvals, or helpdesk workflows can override safeguards too quickly because attackers target the weakest manual exception path.

Common Variations and Edge Cases

Tighter verification often increases friction, requiring organisations to balance faster user experience against stronger fraud resistance. That tradeoff becomes especially visible in customer support, executive requests, and emergency operations, where teams are tempted to relax controls for speed. Current guidance suggests that exceptions should be rare, logged, and independently reviewed, because social engineers deliberately target the exact moments when urgency is highest.

There is no universal standard for this yet, but mature programmes usually adapt controls to risk tier. Low-risk requests may rely on normal authentication plus training-backed awareness. High-risk actions should require stronger identity confirmation, callback validation, or dual approval. The ENISA Threat Landscape remains useful for understanding how social engineering blends with broader threat activity, while NHIMG’s Uber Breach coverage shows how attacker persistence can turn a single deceptive interaction into a wider incident.

One common edge case is multilingual or outsourced support, where script-based training can be weaker than the attacker’s persuasion technique. Another is remote-first organisations that have many legitimate channels and fewer in-person cues. In those environments, awareness training alone becomes a fragile defence unless it is backed by standardised verification paths and strict privilege controls.

Related resources from NHI Mgmt Group

• What do organisations get wrong when they rely on password security alone to stop account takeover?
• What do organisations get wrong when they assume identity security consolidation alone reduces risk?
• What do organisations get wrong when they rely on complaint volume alone?
• What do organisations get wrong when they rely on training completion as a security metric?