Social Engineering and Phishing: Why Training Alone Fails

In 2020, a seventeen-year-old and two accomplices took over the Twitter accounts of Barack Obama, Elon Musk, Apple and dozens of others and used them to run a Bitcoin scam. They didn't exploit a software vulnerability. They phoned Twitter employees, pretended to be from the internal IT department, and talked their way into credentials for an administrative tool. One of the most heavily defended technology companies in the world was breached by a phone call.

Every year, the Verizon Data Breach Investigations Report finds that the majority of breaches — 68% in the 2024 edition — involve a "non-malicious human element": someone falling for social engineering, making a mistake, or misconfiguring something. The security industry's traditional response has been to call people "the weakest link" and to schedule more training. That framing is both unkind and, more importantly, ineffective. People are not a bug in the system. They are the system. Designing security that fails whenever a person behaves like a person is designing failure.

This post is about the human layer: how it's attacked, why the usual defences underperform, and what actually works.

Part 8 of 10 · Foundations of Infosec. Previous: Defence in Depth. Next: Incident Response.

Key takeaways

Social engineering exploits helpfulness, urgency and authority — not software flaws.
68% of breaches involve a non-malicious human element (Verizon DBIR 2024).
Annual awareness training shows little measurable effect; process design and phishing-resistant MFA do.
Make reporting instant and blame-free; give people explicit permission to pause and verify.

How social engineering works

Social engineering is the manipulation of people into taking actions or divulging information that they shouldn't. It works because it exploits things that are, in every other context, virtues: helpfulness, trust in authority, a desire to resolve problems quickly, reluctance to cause a fuss.

The mechanics were catalogued long before email existed. Robert Cialdini's research on influence identified the levers — authority, urgency, reciprocity, social proof, liking, commitment — and every phishing email you've ever received uses at least two of them. "Your account will be suspended in 24 hours" (urgency, authority). "Your colleague shared a document with you" (social proof, curiosity). "The CEO needs these gift cards bought before the board meeting and can't talk right now" (authority, urgency, and a pre-emptive block on verification).

The main forms:

Phishing — mass email pretending to be a trusted sender, aiming for a click, a login on a fake page, or an attachment opened. Still the most common initial access method in most reporting, because it costs nothing and someone always clicks.

Spear phishing — the same, but targeted and researched. The attacker knows your name, your role, your supplier, the project you're working on, all from LinkedIn and your company website. Success rates are far higher than bulk phishing.

Business email compromise (BEC) — the attacker impersonates an executive or a supplier to redirect a payment. No malware, no link, just a well-timed email asking accounts payable to update bank details. The FBI's IC3 has reported BEC losses in the billions of dollars annually, making it consistently among the costliest crime categories they track — far more than ransomware by reported dollar loss.

Vishing and smishing — phone and SMS variants. The Twitter attack was vishing. So was the 2023 MGM Resorts breach, where attackers reportedly impersonated an employee to the help desk and had their MFA reset.

Pretexting — building a plausible scenario over multiple contacts. The "IT department" that calls to fix a problem they created. The "auditor" who needs access to verify compliance.

Physical — tailgating through a secure door, a USB stick left in the car park, a clipboard and a high-vis vest.

The common thread is that none of these attack the technology. They attack the decision a person makes in the moment, using pressure and plausibility to prevent the pause in which they'd think.

Why awareness training underperforms

Almost every organisation runs annual security awareness training, usually a slideshow with a quiz. The evidence that this changes behaviour is weak. A large 2024 study of nearly 20,000 employees at UC San Diego Health, presented at IEEE S&P 2025, found no significant relationship between having completed the training and the likelihood of clicking a subsequent simulated phish. Other studies find modest short-term effects that decay within months.

The reasons are worth understanding, because they point to what works instead:

Training targets knowledge; the attack targets behaviour under pressure. Everyone who fell for a phish knew, in the abstract, that phishing exists. They clicked because they were busy, the email was plausible, and the design of the situation gave them no time to apply what they knew.

The base rate is against you. If one in twenty employees clicks, training that halves that rate still leaves the attacker with dozens of victims in a large organisation. The attacker needs one. Any control that depends on every person getting it right every time is structurally doomed.

Blame poisons reporting. When training is paired with punishment for failing simulations — and it often is — people stop reporting. The employee who clicked and told IT within five minutes is your best outcome; the one who clicked and said nothing, because last time someone got a warning letter, is your worst. Punitive cultures manufacture the second kind.

Simulated phishing is often theatre. Sending fake phishing emails and tracking clicks is useful as a measurement of exposure. As a training tool, its record is mixed, and badly designed simulations (fake bonus announcements, fake layoffs) do lasting damage to trust.

None of this means training is worthless. It means training is a small part of the answer, and the rest of the answer is design.

What actually reduces human-layer risk

Make the right action the easy action. Every control that removes a decision from a person is more reliable than one that asks them to decide correctly. Phishing-resistant MFA means a phished password is useless, so the click doesn't matter. A payment process that requires a callback to a known number before any bank-detail change means the BEC email doesn't matter. Email filtering that quarantines lookalike domains means most phishes never arrive. Aim to make the human the last layer, not the only one.

Fix the processes attackers exploit. BEC works because the payment process has a single point of failure: one email, one person, one action. Add a second person and an out-of-band verification, and BEC becomes nearly impossible regardless of how convincing the email is. The same applies to help-desk password and MFA resets: a defined verification procedure that doesn't rely on knowledge an attacker can research — not "what's your employee number?" — closes the MGM path. Look at every process where a single message can trigger money or access moving, and add friction there specifically.

Make reporting instant, easy and rewarded. A "report phishing" button in the mail client, a Slack channel where "is this legit?" gets a fast answer with no judgement, and public thanks for people who report. Your detection of a phishing campaign depends entirely on the first person who reports it; make sure the first click leads to a report, not to shame.

Train for the specific attacks that matter, briefly and often. Not an annual hour; a five-minute example every month, drawn from what actually hit your organisation or your industry. Show the real email that got through. Explain the tell. People learn from concrete examples relevant to their job far better than from generic modules.

Give people a script for pressure. The single most useful thing you can teach is a pause: "I'll call you back on the number I have on file." "I need to verify this with my manager first." "Our process requires two approvals for that." Attackers rely on the victim feeling unable to say this. Give explicit permission — from the CEO, in writing — to slow down and verify anything involving money, credentials or access, no matter who's asking. Then make sure that when someone does verify, they're thanked and not treated as an obstacle.

Protect the people who are targeted most. Finance, executive assistants, HR and IT support are attacked far more than everyone else, because they're the ones who can move money or grant access. They deserve the strongest controls and the most specific preparation.

Measure, don't moralise. Simulated phishing is fine if you use it to find out which lures work and which processes are exposed, and then fix the processes. It's counterproductive if you use it to rank people.

Building a culture, not a compliance record

"Security culture" is a phrase that's easy to say and hard to describe. Here's what it looks like from the inside of an organisation that has one:

People report mistakes quickly because they've seen that reporting is met with help, not blame. The phrase "just culture", borrowed from aviation safety, describes this: honest errors are learned from; only reckless or malicious behaviour is punished.
Security is discussed in the same breath as quality and customer service, not as a separate compliance chore.
Leaders visibly follow the rules. A CEO who demands an exception to MFA has just told the whole company what the rules are worth.
The security team is approachable and fast. If asking "is this safe?" takes three days to answer, people stop asking.
New joiners hear about security in their first week from a human, not just a module, and are told explicitly: you will never be in trouble for pausing to verify.

Culture is downstream of what leadership rewards. If the finance team is praised for processing payments fast and never for catching a fraud attempt, you have told them which matters.

The honest framing

People will click. They'll pick up the phone. They'll hold the door. Not because they're careless, but because they're human, and a skilled attacker is exploiting exactly the qualities that make them good colleagues. A security programme that requires them to stop being human will fail, and will make them feel bad while failing.

The programme that works assumes the click will happen and asks: what then? It puts phishing-resistant MFA in front of the credentials, a second pair of eyes in front of the payment, segmentation behind the endpoint, and a friendly voice on the other end of "I think I did something stupid". Then it trains people — briefly, specifically, without blame — to recognise the pressure and reach for the pause.

Twitter's employees weren't the weakest link. A help-desk process that would grant admin-tool access on the strength of a phone call was. Fix the process, support the people, and the phone call stops working.

Further reading

Verizon, 2024 Data Breach Investigations Report
FBI Internet Crime Complaint Center, Internet Crime Report (annual) — business email compromise losses
Robert B. Cialdini, Influence: The Psychology of Persuasion
Ho, Mirian et al., "Understanding the Efficacy of Phishing Training in Practice", IEEE Symposium on Security and Privacy (2025)
New York State Department of Financial Services, Twitter Investigation Report (October 2020)
Sidney Dekker, Just Culture: Restoring Trust and Accountability in Your Organization
NCSC (UK), Phishing attacks: defending your organisation

This series