The Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses identified a breach or cyber attack in the previous 12 months. Among those affected businesses, 85% reported phishing, making it the most common type of attack by a significant margin.
Traditional annual awareness training has a role to play, but it is not enough on its own. Attackers now combine targeted reconnaissance, compromised accounts, convincing impersonation and pressure tactics to influence decisions across email, collaboration platforms, mobile phones and business processes.
The risk is not limited to a user clicking a suspicious link. Social engineering can influence payment approvals, supplier changes, password resets, access requests and the handling of sensitive information. Effective protection therefore requires more than compliance training. It requires a coordinated approach across identity controls, business processes, monitoring and employee behaviour.
This guide explains how social engineering exploits organisational trust and how businesses can build more resilient defences. It covers the main attack techniques, the role of phishing-resistant authentication, human risk management, social engineering testing and managed detection and response.
Social engineering is the use of deception or psychological manipulation to influence a person into taking an action that benefits an attacker. That action may involve disclosing information, approving a login request, changing payment details or granting access to a system.
Unlike attacks that rely solely on a software vulnerability, social engineering targets the way people make decisions. Attackers may exploit:
The NCSC recommends treating phishing as a people, process and technology issue. Training remains useful, but it should sit alongside email security, strong authentication, safer business processes, monitoring and a reporting culture that does not discourage people from raising concerns.
Attackers increasingly use information from public websites, social media, corporate filings and compromised accounts to make their approaches more credible. The objective is often to create a familiar and plausible interaction rather than an obviously suspicious message.
Generative AI can make it easier to produce convincing written content, translate messages and adapt a lure to a particular organisation. Other techniques may include:
The presence of AI does not remove the need for basic controls. It reinforces the need for independent verification, clear approval processes and authentication methods that are resistant to phishing.
Phishing uses deceptive messages or websites to obtain information, deliver malware or persuade someone to take an action. Spear phishing applies the same principle to a specific person, role or organisation.
Business email compromise is a related threat in which attackers use spoofed identities, compromised mailboxes or fraudulent accounts to influence financial transactions and other business processes. Common examples include:
CISA recommends independent, out-of-band verification for high-risk requests. This means using a trusted communication channel and contact details already held in an approved record, rather than replying to the original message or using the contact information it contains.
A clear policy should state that payment or bank-detail changes are not approved solely by email. Dual approval, documented callbacks and separation of duties can reduce the chance that one deceptive interaction results in a financial loss.
Multi-factor authentication improves security, but not all MFA methods provide the same level of protection. In an attacker-in-the-middle attack, a malicious proxy sits between the user and the legitimate login service. The victim may see a genuine-looking login process while the attacker relays the interaction and attempts to obtain credentials or an authenticated session.
MFA fatigue attacks use repeated approval prompts to pressure a user into accepting a request. NCSC guidance identifies both session-relay attacks and push-notification fatigue as reasons to choose MFA methods based on their resistance to phishing rather than treating all MFA as equivalent.
Phishing-resistant methods such as FIDO2 security keys, passkeys and Windows Hello for Business use cryptographic credentials that are tied to the legitimate service or device. Microsoft Entra ID supports these methods through authentication-strength and Conditional Access policies.
These controls should be combined with risk-based access policies, least privilege, device security and appropriate token protection. Phishing-resistant authentication addresses an important part of the attack chain, but it is not a substitute for endpoint security or monitoring.
Social engineering resilience is strongest when technical controls, business processes and employee behaviour reinforce one another. A practical programme should focus on four areas.
Organisations should prioritise phishing-resistant authentication for privileged users, administrators, remote access and other high-value accounts. Within Microsoft Entra ID, useful controls may include:
Microsoft guidance explains that token protection can help reduce the risk of stolen token replay in supported scenarios. It should be considered alongside phishing-resistant authentication rather than treated as a replacement for it.
The objective is not to add controls for their own sake. It is to reduce the number of opportunities for an attacker to turn a compromised identity into wider access.
Technical controls cannot verify whether a supplier really requested a bank-detail change or whether an executive genuinely authorised an unusual payment. Business processes must address those decisions directly.
Useful safeguards include:
These measures are particularly important for finance, procurement, HR, executive support and IT administration teams.
Annual awareness training can provide a baseline, but it rarely creates lasting behavioural change by itself. A stronger human risk management programme combines:
The aim is not to make employees responsible for defeating every attack. It is to design an environment in which people can pause, verify and report suspicious activity without creating unnecessary operational friction.
Social engineering can also lead to accidental disclosure through email, file sharing and collaboration platforms. Microsoft Purview capabilities may help organisations classify sensitive information, apply data loss prevention policies and control external sharing, depending on the services and licensing in use.
Any product claim should be checked against the organisation’s Microsoft 365 configuration and licensing position. The intended outcome is clearer control over sensitive information, not the assumption that data protection policies can prevent every disclosure.
Testing helps organisations understand whether documented controls work under realistic pressure. An authorised social engineering assessment may examine:
The purpose is to identify weaknesses in process design, control coverage and decision-making. Testing should be planned carefully, authorised by the appropriate stakeholders and designed to avoid unnecessary disruption or harm.
Tabletop exercises provide a complementary view. A scenario involving a compromised supplier, fraudulent payment request or executive impersonation can test how security, finance, legal, communications and executive teams work together.
A useful report should do more than list failures. It should provide prioritised actions, identify control owners and distinguish between immediate remediation and longer-term improvement.
No organisation can rely on employee judgement alone. Monitoring and response capabilities are needed to identify suspicious activity and contain mistakes quickly.
Depending on the environment, useful detection measures may include:
A managed detection and response service can provide continuous monitoring and support investigation and containment. The specific actions available will depend on the Microsoft services deployed, the organisation’s permissions and the operating model agreed with the provider.
Response playbooks may include disabling an account, revoking sessions, isolating a device, resetting credentials and investigating mailbox or cloud activity. Organisations should confirm which actions are automated, which require approval and how quickly the service can respond.
Social engineering cannot be addressed through awareness training alone. Organisations need a coordinated model that combines phishing-resistant identity controls, safer approval processes, role-specific coaching, monitoring and rehearsed response.
The most effective programmes also measure progress. Useful measures may include:
This approach helps leadership move from general awareness claims to evidence of improved resilience.
As a Microsoft Security Elite Partner, CyberOne helps organisations assess, implement and operate Microsoft-powered security capabilities. Where the relevant accreditations, memberships and service capabilities have been confirmed, CyberOne can support organisations through identity improvement, human risk management, resilience testing and managed detection and response.
The objective is practical: reduce exposure, improve visibility and provide evidence of progress towards stronger operational resilience.