Attackers no longer need to break through your firewall. They call your help desk, text your finance team, or email your executive assistant and ask to be let in.Verizon's 2026 Data Breach Investigations Report found the human element present in 62% of breaches, up from 60% the prior year. Firewalls, endpoint tools, and encryption do not stop an employee who willingly hands over access. For executives, social engineering is a business risk measured in wire transfers, ransomware payments, and lost contracts.
Sera Brynn has tested how organizations withstand attack since 2011. Veterans of the intelligence and military communities founded the firm, and it holds GSA designations for penetration testing, incident response, and risk and vulnerability assessments. As an Authorized C3PAO, Sera Brynn evaluates defense contractors against the controls that govern human risk. The attacks our incident response and forensics teams investigate shape the social engineering scenarios we build.
Social Engineering Defined
Social engineering is a cyberattack that manipulates people into revealing information, granting access, or moving money. It exploits trust, urgency, and authority rather than software flaws.
A compromise of an attacker's target is a decision, not a system. One approved password reset, one opened attachment, or one paid invoice gives the attacker a foothold that technical controls treat as legitimate activity.
Common Social Engineering Attacks
Social engineering has moved beyond the inbox. Verizon found that simulated voice and text attacks draw a median click rate 40% higher than email.
Pretexting deserves executive attention. Verizon reports it now serves as an initial access vector in 6% of all breaches and increasingly precedes ransomware and extortion.
The Business Cost of Social Engineering
Business email compromise alone cost U.S. organizations $3.05 billion in 2025 across 24,768 complaints, according to the FBI's Internet Crime Complaint Center. That averages roughly $123,000 per reported incident, before legal fees, downtime, or lost customers.
These attacks succeed because they exploit how organizations operate:
- Authority goes unchallenged. Employees act fast on requests from executives, vendors, and IT.
- Urgency overrides verification. A deadline or crisis pushes staff to skip callback procedures.
- Workflows hide fraud. A changed bank account on a routine invoice looks like normal business.
- AI removes red flags. The FBI tracked $893 million in AI-linked fraud losses in 2025, its first year reporting the category.
A successful attack rarely ends with one lost wire. Stolen credentials become ransomware deployment, data exfiltration, regulatory disclosure, and contract risk.
Social Engineering and CMMC Requirements
Defense contractors carry a documented obligation to address human risk. The Awareness and Training domain of CMMC Level 2, drawn from NIST SP 800-171, requires organizations to:
- Make managers, administrators, and users aware of security risks tied to their activities (AT.L2-3.2.1)
- Train personnel to carry out assigned security duties (AT.L2-3.2.2)
- Train staff to recognize and report potential indicators of insider threat (AT.L2-3.2.3)
These obligations remain in force under DFARS 252.204-7012 regardless of CMMC rollout timing. Training completion records show that a program exists. Social engineering testing shows whether employees apply it.
Social Engineering Assessment Methodology
A social engineering assessment measures how employees respond to controlled attacks that mirror current threats. It replaces assumptions about awareness with behavioral data leadership can track.
- Design. Define scope, cadence, and objectives around your structure and risk profile.
- Scenarios. Build attacks that reflect how adversaries target your roles and workflows.
- Test. Run controlled simulations across email, phone, text, and targeted pretexts.
- Measure. Track clicks, credential submissions, and reports of suspicious activity.
- Report. Deliver findings that isolate behaviors, roles, and trends requiring attention.
Four metrics give executives a clear read on human risk:
Report rate matters as much as click rate. An employee who clicks and reports within minutes limits damage. An employee who ignores the message protects no one else.
Testing must extend past email. Verizon's 2026 dataset captured only 35 simulated voice and text campaigns, yet those channels outperformed email for attackers.
People Are Part of Your Attack Surface
Every employee, vendor contact, and public executive profile is an entry point. Attackers map LinkedIn titles, org charts, press releases, and vendor relationships before they send the first message.
This human exposure sits alongside your technical exposure: internet-facing systems, cloud services, and third-party integrations. Verizon found third-party involvement in 48% of 2026 breaches, a 60% increase over the prior year. Attackers rarely choose between people and systems. They use one to reach the other.
Social engineering testing measures one layer of risk. Attack surface analysis maps the full picture. Read our guide to attack surface analysis to see how the two fit together.
Technical layers carry their own testing: penetration testing, vulnerability assessment, and red teaming, which combines human and technical attack paths in a single engagement.
Social Engineering Testing with Sera Brynn
Sera Brynn delivers social engineering testing built to track behavior over time and show leadership whether human risk is declining. Certified professionals design each program around your risk profile, communication patterns, and objectives.
- Phishing simulations. Realistic email scenarios.
- Targeted scenarios. Role-specific attack paths.
- Behavior tracking. Clicks and reporting.
- Executive reporting. Patterns and trends.
One defense contractor cut its click-through rate from 25% to under 5% through targeted social engineering tests.
Start with a free phishing simulation sample or talk with our team about a full program.
Frequently Asked Questions
What is social engineering in cybersecurity?
Social engineering is the manipulation of people into revealing information, granting access, or transferring money. Attackers exploit trust and urgency instead of technical vulnerabilities.
What is the most common type of social engineering attack?
Phishing remains the most common. Verizon's 2026 DBIR lists phishing as the initial access vector in 16% of breaches, with pretexting at 6% and rising.
How is social engineering different from phishing?
Phishing is one form of social engineering. Social engineering also includes vishing, smishing, pretexting, impersonation, and physical intrusion.
Does security awareness training stop social engineering?
Training builds knowledge. Testing confirms whether employees apply it under realistic pressure. Organizations need both.
How often should organizations run social engineering tests?
Most organizations test at regular intervals, often quarterly, to measure improvement over time. Frequency depends on risk profile, workforce turnover, and regulatory obligations.
Will employees know they are being tested?
The organization decides during design. Some choose announced simulations. Others run unannounced tests to reflect real conditions.
Does social engineering testing support CMMC compliance?
Testing produces evidence of how personnel respond to threats covered in the Awareness and Training domain. It complements, and does not replace, a documented training program.