ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Adversary insights →Five myths about social engineering security testing
Plan useful, authorised social-engineering exercises without confusing click rates, blame or unrestricted realism with assurance.
Plan useful, authorised social-engineering exercises without confusing click rates, blame or unrestricted realism with assurance.
Need an acronym translated?Open the cyber glossary →Myth one only careless people are affected
Social engineering exploits working context, authority, urgency and the way a process is designed. An employee handling a credible supplier request may face a harder decision than a generic training message suggests. Define which workflow needs assessment and what protective steps should help the person make a safe choice. Avoid using an exercise as a shortcut to blaming individuals.
Myth two a click rate explains the whole risk
A click does not describe what happened next. Different outcomes include opening a message, entering information, approving a change, reporting suspicion or stopping a transaction. Agree meaningful measures before the exercise and interpret them alongside the scenario and safeguards. A result from one audience or pretext is not a universal measure of the organisation's susceptibility.
Myth three realistic means unrestricted
A realistic exercise can still have clear exclusions and safety limits. Agree permitted channels, recipients, timing, data handling, escalation contacts and stop conditions. Active assessment requires explicit written authorisation. Sensitive personal circumstances and high-consequence operational processes need careful treatment. Realism should support the assurance objective, not become permission for uncontrolled distress, financial impact or access beyond the agreed scope.
Myth four technical controls make process testing unnecessary
Email protection, identity controls and device security are important, but a convincing request may also exploit a weak approval or verification process. Examine how staff authenticate a change, escalate an unusual request and recover from an error. Assess the interaction between people, process and technology instead of treating them as independent scores that can compensate for one another automatically.
Myth five a failed exercise has no value
An exercise stopped by a well-designed control can provide useful evidence about how that control works. A successful reporting or escalation action is worth understanding, not hiding. Record the sequence and the conditions that influenced the outcome. Keep conclusions proportional: one blocked attempt does not prove every attack route is closed, and one successful attempt does not explain every control failure.
Convert the exercise into practical improvements
Debrief the process owners and agree specific changes to verification, reporting, escalation, technical controls and training. Assign owners and decide how the new approach will be checked. Social-engineering assessment should create a more resilient operating process, with the agreed safeguarding and privacy boundaries intact. Select an Adversary or other testing engagement according to the actual objective and authorised scope.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Internal security is defined by attack paths, not network boundaries” →
