Why one of the hardest threats to stop gets around any firewall
Bologna, 4:47 p.m. The working day is almost over. Luigi is looking at a photo of his newborn twins and thinking about going home. The phone rings. A woman, agitated, with an Eastern European accent, and a baby crying in the background. She says her name is Alena and she’s the wife of a colleague. Her husband rushed off to Poland and forgot an important document, and she’s alone with a three-week-old baby and doesn’t know how to fill it in. Could he help?
Luigi helps. He asks the baby’s name: Marco, just like one of his twins. She gets a code, a date, the plant code. In the end he agrees to receive the document at his company email address, so he can double-check it before forwarding it. “You’re an angel, Luigi!”
Luigi hangs up, happy to have helped a colleague’s wife. On the other end of the line there is no Alena. There is Màlinka.
Màlinka turns off the MP3.
The sound of the crying baby cuts out. She catches her breath. It worked. In a few minutes, on the other end of the phone, someone has just opened a door that no firewall could have closed.
If a threat actor had to choose between breaking through your firewall and calling one of your employees, which do you think they’d pick?
Almost always, the second.
Not because firewalls are useless. But because people are easier to deceive than anyone likes to admit. They’re helpful, cooperative, distracted. They have newborn children, overdue deadlines, colleagues they trust. They live in the real world, not in a security manual.
Social engineering is the art of exploiting all of this. It needs no code, no vulnerabilities, no sophisticated tools. It needs a precise understanding of how the human mind works under pressure. That’s why it is one of the most effective attack vectors there is, and one of the hardest to defend against.
The problem no update can fix
Go back to Luigi’s phone call. A kind voice, a little agitated. The wife of a colleague, a husband who rushed off for a family emergency, an important company document left behind. A small child crying, a woman alone and struggling, asking only for a little help.
What would you have done in his place?
Most people would help. Without hesitation, without suspicion. Because it’s what you do. Because it feels like the right thing. Because refusing to help someone in distress takes an emotional effort that, in that moment, we aren’t willing to make.
This is exactly where a social engineering attack begins. Not with a technical vulnerability, but with a human one. And human vulnerabilities can’t be patched with a software update.
The human mind is not a secure system
In 1984, psychologist Robert Cialdini published Influence: The Psychology of Persuasion. The book described six principles that guide human behavior in social decisions. Cialdini studied them to understand how legitimate persuasion works. But the same principles, applied with malicious intent, have become the unwritten playbook of every social engineer.
A skilled threat actor doesn’t improvise. They build a scenario in which every response from the victim feels like the right one, the one anyone in their place would give.
Reciprocity. When someone does us a favor, we feel we owe them something. A threat actor who comes across as helpful and considerate exploits this right away: the victim wants to help because they feel they should return the kindness. Kindness becomes a weapon.
Liking. We’re more inclined to go along with people we like or identify with. A detail in common, a child of the same age, a city, a passion: it’s enough to lower our guard. We rarely refuse a favor to someone we share something with.
Authority. We tend to obey those we perceive as authoritative. A professional tone, a colleague’s name dropped naturally, a reference to an internal procedure: a few elements are enough to build a credibility the victim has no reason to question. Verifying would take time. Trusting is easier.
Scarcity. It’s the tendency to attach more value to what we perceive as rare or running out. In social engineering it almost always shows up in its most direct form: time. An imminent deadline, a problem to solve right now, a window about to close. When time is short, critical thinking shrinks: urgency switches off reflection and switches on action. Under pressure, the brain takes shortcuts. Threat actors know this.
Social proof. We do what others do, especially in ambiguous situations. If the request seems normal, the kind of thing anyone would do in our place, our guard drops automatically.
Commitment and consistency. Once we’ve said yes to a small request, we tend to stay consistent. The threat actor builds the conversation so that every step feels like the natural continuation of the last. They don’t ask for everything at once: they ask for a little, then a little more, until the victim has already given everything that was needed without realizing it.
Reread the phone call. The crying baby and the husband’s rush: urgency. The name “Marco” and the twins: liking. The colleague mentioned so naturally: authority. One question after another, each small, each reasonable: commitment and consistency. Four principles in a few minutes, and at no point did Luigi have a moment when helping felt wrong.
The channels technology doesn’t control
The cybersecurity industry has invested billions in tools to detect and block attacks before they reach people: anti-phishing filters, email analysis, sandboxes for attachments, artificial intelligence trained to recognize suspicious patterns. Tools that work, within limits.
The problem is that social engineering doesn’t necessarily travel through those channels.
A phone call has no spam filter. A LinkedIn message isn’t scanned by the company’s security gateway. A meeting at a trade fair triggers no alert in the SIEM. A chat in a bar between a sales rep and someone who introduced himself as a prospective customer, but was really gathering information about the company’s internal structure, leaves no trace in the logs.
Social engineering works precisely because it moves through the spaces technology can’t police. And those spaces are everywhere.
It’s not the fault of whoever picks up the phone
According to the Verizon Data Breach Investigations Report 2026, the human element (a mistake, a compromised credential, a deception) was involved in about 62% of breaches. Not a technical vulnerability: a person who did something they shouldn’t have, often in perfectly good faith.
This figure is not a criticism of people. It’s a description of reality.
Employees aren’t trained to live in a state of permanent suspicion. That’s not their job. Their job is to do what they were hired for, and doing it well takes trust, cooperation, helpfulness. The very qualities a social engineer tries to exploit.
There’s also the matter of context. An employee who gets an unusual request at 4:47 on a Friday, with three urgent emails still open and a meeting in twenty minutes, is not in the best position to critically assess every interaction. The cognitive load is high, attention is low, and the brain takes shortcuts.
Threat actors choose their moment carefully. They know a Friday afternoon is different from a Tuesday morning. They know that vacation periods, moments of organizational change and company crises lower people’s guard even further. They know that some people, such as new hires, front-office staff, and those who manage relationships with suppliers and customers, are structurally more exposed than others.
It’s not a matter of intelligence or competence. It’s a matter of conditions.
Defense is possible. But it starts from a different place
Knowing the mechanisms doesn’t make anyone immune. But it changes the threshold of attention, and in social engineering that makes an enormous difference.
An employee who recognizes the principle of scarcity pauses a second longer when a request can’t wait. One who knows what social proof is asks why something that seems obvious is pushing them to act without checking. Someone who has seen concrete examples of attacks, not abstract slides but real, recognizable stories that could happen to them tomorrow, develops a different instinct.
Security training, when it’s done well, doesn’t teach rules. It teaches people to recognize patterns. And the patterns of social engineering are always the same: scarcity and urgency, authority, liking, a request that seems normal.
But training alone isn’t enough. You need a company culture where raising a doubt isn’t seen as slowing things down. Where saying “wait, let me check” is considered professional, not paranoid. Where verifying identities, even for requests that seem obvious, is part of the routine.
Because the threat actor is counting on verification being inconvenient. Counting on questioning a request feeling rude. Counting on social pressure and artificial urgency being stronger than the protocol.
Taking that advantage away from them is possible. It takes time, intention and consistency. But it’s an essential defense against a threat that gets around any firewall.
Is your security as strong as the person who picks up the phone at 4:47 on a Friday afternoon?