SecurityRingBook a Demo

Glossary

What is social engineering?

Manipulating people, rather than breaking technology, to get information, money or access. Phishing, vishing, smishing and pretexting are all forms of it.

How it works

CISA defines a social engineering attack as one in which an attacker uses human interaction (social skills) to obtain or compromise information about an organisation or its systems. It describes phishing as a form of social engineering that uses email or malicious websites to pose as a trustworthy organisation.

A real example

Microsoft’s 2024 report on Storm-1811 shows several techniques chained together: an email flood, a phone call posing as IT support, and a request to open Quick Assist and type a code. Each step relied on the victim’s trust.

How to train for it

  • Teach the common levers: urgency, authority, helpfulness and fear.
  • Make verifying and reporting easy and blame-free.
  • Practise on realistic scenarios across the channels attackers use.

SecurityRing runs live email simulations, including QR-code, ClickFix and deepfake video in email. WhatsApp is a private beta, and LinkedIn, voice-call and SMS simulations are coming soon.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. CISAAvoiding Social Engineering and Phishing AttacksAccessed 17 October 2026.
  2. Microsoft Threat IntelligenceThreat actors misusing Quick Assist in social engineering attacks leading to ransomwarePublished 15 May 2024 · Accessed 17 October 2026.