Social Engineering & Enterprise Defence: Strategic Risk Reduction for 2026

The Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses identified a breach or cyber attack in the previous 12 months. Among those affected businesses, 85% reported phishing, making it the most common type of attack by a significant margin. 

Traditional annual awareness training has a role to play, but it is not enough on its own. Attackers now combine targeted reconnaissance, compromised accounts, convincing impersonation and pressure tactics to influence decisions across email, collaboration platforms, mobile phones and business processes.

The risk is not limited to a user clicking a suspicious link. Social engineering can influence payment approvals, supplier changes, password resets, access requests and the handling of sensitive information. Effective protection therefore requires more than compliance training. It requires a coordinated approach across identity controls, business processes, monitoring and employee behaviour.

This guide explains how social engineering exploits organisational trust and how businesses can build more resilient defences. It covers the main attack techniques, the role of phishing-resistant authentication, human risk management, social engineering testing and managed detection and response.

What Is Social Engineering?

Social engineering is the use of deception or psychological manipulation to influence a person into taking an action that benefits an attacker. That action may involve disclosing information, approving a login request, changing payment details or granting access to a system.

Unlike attacks that rely solely on a software vulnerability, social engineering targets the way people make decisions. Attackers may exploit:

• Perceived authority, such as a request from a senior executive
• Urgency, such as an alleged payment deadline
• Familiarity, such as an existing supplier relationship
• Fear of disruption, financial loss or disciplinary action
• Helpfulness, particularly in customer service, HR and administrative roles
• Trust in an established email thread or collaboration workspace

The NCSC recommends treating phishing as a people, process and technology issue. Training remains useful, but it should sit alongside email security, strong authentication, safer business processes, monitoring and a reporting culture that does not discourage people from raising concerns.

How Modern Deception Works

Attackers increasingly use information from public websites, social media, corporate filings and compromised accounts to make their approaches more credible. The objective is often to create a familiar and plausible interaction rather than an obviously suspicious message.

Generative AI can make it easier to produce convincing written content, translate messages and adapt a lure to a particular organisation. Other techniques may include:

• Voice Impersonation: Using synthetic or manipulated audio to imitate a known person.
• Relationship Mapping: Identifying reporting lines, suppliers and approval routes from publicly available information.
• Contextual Lures: Referencing a current project, invoice, recruitment process or regulatory issue.
• Multi-Channel Pressure: Moving a conversation from email to telephone, text message or collaboration software.

The presence of AI does not remove the need for basic controls. It reinforces the need for independent verification, clear approval processes and authentication methods that are resistant to phishing.

The Main Social Engineering Threats

Phishing, Spear Phishing & Business Email Compromise

Phishing uses deceptive messages or websites to obtain information, deliver malware or persuade someone to take an action. Spear phishing applies the same principle to a specific person, role or organisation.

Business email compromise is a related threat in which attackers use spoofed identities, compromised mailboxes or fraudulent accounts to influence financial transactions and other business processes. Common examples include:

• Requests to change supplier bank details
• Urgent payment or invoice instructions
• Payroll or direct-deposit changes
• Requests for sensitive information
• Password reset or MFA-change requests
• Executive requests made under unusual confidentiality or time pressure

CISA recommends independent, out-of-band verification for high-risk requests. This means using a trusted communication channel and contact details already held in an approved record, rather than replying to the original message or using the contact information it contains.

A clear policy should state that payment or bank-detail changes are not approved solely by email. Dual approval, documented callbacks and separation of duties can reduce the chance that one deceptive interaction results in a financial loss.

Attacker-In-The-Middle Attacks & MFA Fatigue

Multi-factor authentication improves security, but not all MFA methods provide the same level of protection. In an attacker-in-the-middle attack, a malicious proxy sits between the user and the legitimate login service. The victim may see a genuine-looking login process while the attacker relays the interaction and attempts to obtain credentials or an authenticated session.

MFA fatigue attacks use repeated approval prompts to pressure a user into accepting a request. NCSC guidance identifies both session-relay attacks and push-notification fatigue as reasons to choose MFA methods based on their resistance to phishing rather than treating all MFA as equivalent.

Phishing-resistant methods such as FIDO2 security keys, passkeys and Windows Hello for Business use cryptographic credentials that are tied to the legitimate service or device. Microsoft Entra ID supports these methods through authentication-strength and Conditional Access policies.

These controls should be combined with risk-based access policies, least privilege, device security and appropriate token protection. Phishing-resistant authentication addresses an important part of the attack chain, but it is not a substitute for endpoint security or monitoring.

Building Layered Defences

Social engineering resilience is strongest when technical controls, business processes and employee behaviour reinforce one another. A practical programme should focus on four areas.

Identity Architecture & Conditional Access

Organisations should prioritise phishing-resistant authentication for privileged users, administrators, remote access and other high-value accounts. Within Microsoft Entra ID, useful controls may include:

• Phishing-resistant authentication strengths
• Conditional Access policies based on user, device, location and risk
• Privileged Identity Management and just-in-time access
• Restrictions on legacy authentication
• Session controls and token protection where supported
• Regular reviews of privileged roles and authentication methods

Microsoft guidance explains that token protection can help reduce the risk of stolen token replay in supported scenarios. It should be considered alongside phishing-resistant authentication rather than treated as a replacement for it.

The objective is not to add controls for their own sake. It is to reduce the number of opportunities for an attacker to turn a compromised identity into wider access.

Safer Business Processes

Technical controls cannot verify whether a supplier really requested a bank-detail change or whether an executive genuinely authorised an unusual payment. Business processes must address those decisions directly.

Useful safeguards include:

• Independent verification for payment, payroll and bank-detail changes
• Dual approval for high-value or unusual transactions
• Clear escalation routes for suspicious requests
• Approved contact records for suppliers and key partners
• Restrictions on who can change authentication methods
• Documented procedures for suspected account compromise
• Regular review of mailbox rules, forwarding settings and delegated access

These measures are particularly important for finance, procurement, HR, executive support and IT administration teams.

Human Risk Management

Annual awareness training can provide a baseline, but it rarely creates lasting behavioural change by itself. A stronger human risk management programme combines:

• Role-specific guidance for finance, HR, executives and administrators
• Short, regular learning interventions
• Controlled simulations based on relevant business processes
• Easy reporting routes
• Feedback after exercises
• Measures that track reporting, verification and response behaviour
• A clear, blame-free approach to mistakes and near misses

The aim is not to make employees responsible for defeating every attack. It is to design an environment in which people can pause, verify and report suspicious activity without creating unnecessary operational friction.

Data & Collaboration Controls

Social engineering can also lead to accidental disclosure through email, file sharing and collaboration platforms. Microsoft Purview capabilities may help organisations classify sensitive information, apply data loss prevention policies and control external sharing, depending on the services and licensing in use.

Any product claim should be checked against the organisation’s Microsoft 365 configuration and licensing position. The intended outcome is clearer control over sensitive information, not the assumption that data protection policies can prevent every disclosure.

Testing Resilience Before An Attack

Testing helps organisations understand whether documented controls work under realistic pressure. An authorised social engineering assessment may examine:

• Targeted phishing and spear-phishing
• Telephone-based deception
• Physical access attempts
• Supplier impersonation
• Payment-change scenarios
• MFA fatigue and account recovery processes
• Reporting and escalation routes

The purpose is to identify weaknesses in process design, control coverage and decision-making. Testing should be planned carefully, authorised by the appropriate stakeholders and designed to avoid unnecessary disruption or harm.

Tabletop exercises provide a complementary view. A scenario involving a compromised supplier, fraudulent payment request or executive impersonation can test how security, finance, legal, communications and executive teams work together.

A useful report should do more than list failures. It should provide prioritised actions, identify control owners and distinguish between immediate remediation and longer-term improvement.

Detecting & Containing Compromise

No organisation can rely on employee judgement alone. Monitoring and response capabilities are needed to identify suspicious activity and contain mistakes quickly.

Depending on the environment, useful detection measures may include:

• Unusual sign-in locations or devices
• Suspicious mailbox rules and forwarding
• Changes to authentication methods
• Unusual consent grants or application access
• Privilege escalation
• Abnormal data downloads
• Repeated MFA prompts
• Activity associated with compromised accounts

A managed detection and response service can provide continuous monitoring and support investigation and containment. The specific actions available will depend on the Microsoft services deployed, the organisation’s permissions and the operating model agreed with the provider.

Response playbooks may include disabling an account, revoking sessions, isolating a device, resetting credentials and investigating mailbox or cloud activity. Organisations should confirm which actions are automated, which require approval and how quickly the service can respond.

Moving From Awareness To Resilience

Social engineering cannot be addressed through awareness training alone. Organisations need a coordinated model that combines phishing-resistant identity controls, safer approval processes, role-specific coaching, monitoring and rehearsed response.

The most effective programmes also measure progress. Useful measures may include:

• Adoption of phishing-resistant authentication
• Coverage of privileged accounts
• Time taken to report suspected deception
• Time taken to revoke access or contain a device
• Completion of high-risk remediation actions
• Results from social engineering exercises
• Reduction in repeat findings
• Evidence that payment and supplier-change controls are operating as designed

This approach helps leadership move from general awareness claims to evidence of improved resilience.

As a Microsoft Security Elite Partner, CyberOne helps organisations assess, implement and operate Microsoft-powered security capabilities. Where the relevant accreditations, memberships and service capabilities have been confirmed, CyberOne can support organisations through identity improvement, human risk management, resilience testing and managed detection and response.

The objective is practical: reduce exposure, improve visibility and provide evidence of progress towards stronger operational resilience.