Glossary
What is pretexting? The invented story behind social engineering
The invented story, or pretext, an attacker uses to make a request look normal: a new employee, an IT technician, a supplier or an executive in a hurry.
How it works
CISA’s guidance on social engineering describes an attacker who seems “unassuming and respectable”, claiming to be a new employee, repair person or researcher and even offering credentials to support that identity. By asking questions across several people, the attacker pieces together enough to get in. The story is the pretext; every later request leans on it.
A real example
Microsoft reported in 2024 that Storm-1811 first caused a problem (an email flood) and then called the target posing as IT support offering to fix it. The pretext, “I’m from the help desk and I can stop the spam”, made a request for remote access feel helpful rather than hostile.
How to train for it
- Check the story, not just the request: would this person really contact you this way?
- Verify identity through a channel you choose.
- Notice when a problem and its “solution” arrive together.
SecurityRing’s email simulations use pretexts drawn from your company and industry, such as payroll updates and supplier bank changes, and the lesson shows the employee the pretext they fell for.
Sources
Every clause, incident and figure above comes from these official or original sources.
- CISAAvoiding Social Engineering and Phishing AttacksAccessed 17 October 2026.
- Microsoft Threat IntelligenceThreat actors misusing Quick Assist in social engineering attacks leading to ransomwarePublished 15 May 2024 · Accessed 17 October 2026.