CLAIMS
Log In

The Invisible Threat: How Social Engineers Target Your District

enduris flame grey

Every organization invests in firewalls, antivirus software, and secure passwords. Attackers know this. That’s why the most successful cyberattacks today don’t target your technology at all. They target your people. This approach has a name: social engineering. And in 2026, the human element is involved in most organizational data breaches worldwide.1

What Is Social Engineering?

Social engineering is the art of manipulating people into doing something they wouldn’t normally do, like handing over a password, wiring money to an unfamiliar account, or clicking a link that installs malicious software. Unlike a hacker who exploits a flaw in your computer system, a social engineer exploits a flaw in human nature: our tendency to trust, to help, to act quickly under pressure, and to defer to authority.

According to Verizon’s 2026 Data Breach Investigations Report, the human element, including phishing, social engineering, and errors, contributed to 62% of all data breaches.2 No firewall can block a well-timed phone call.

How Attackers Do It

Social engineers use a range of tactics, often combining several at once:

  • Phishing emails: Fraudulent messages that appear to come from a trusted source (your bank, your IT department, or even a colleague), asking you to click a link, open an attachment, or confirm your login credentials.
  • Vishing (voice phishing): A phone call from someone impersonating IT support, a government agency, or a vendor, pressuring you to take immediate action.
  • Pretexting: The attacker constructs a believable backstory, posing as a new vendor, an auditor, or a consultant, to build enough trust to extract sensitive information over time.
  • AI-generated deepfakes: Using as little as a few seconds of publicly available audio or video, attackers can now clone a colleague’s or executive’s voice and appearance with alarming accuracy.3

Real-World Consequences

In early 2024, a finance employee at a multinational corporation in Hong Kong transferred more than US$25 million after attending a video conference call in which every other participant, including the company’s CFO, was a deepfake. The employee had initially suspected a phishing attempt but was convinced by the realistic video likenesses of people he recognized.4

These are not isolated incidents. They are the new normal. And the common denominator in each case was not a software failure. It was a person who had no reason to doubt what they were seeing or hearing.

Warning Signs to Watch For

Common red flags include:5

  • Urgency or pressure to act immediately, especially around financial transactions or login credentials
  • Requests that bypass normal procedures: “Just this once, skip the approval process”
  • Unexpected emails or calls asking you to verify account information
  • Messages with generic greetings, unusual sender addresses, or subtle spelling errors
  • Anyone asking you to keep a request confidential from your manager or IT team

What You Can Do

Defending against social engineering does not require technical expertise. It requires healthy skepticism and consistent habits:

  • Verify before you act. If a request feels unusual, even from a known contact, confirm it through a separate channel. Call the person back on a number you already have, not one they provided.
  • Slow down. Urgency is a manipulation tactic. A legitimate IT department or financial institution will allow you time to verify a request.
  • Report suspicious contacts. If you receive a suspicious email, call, or message, report it to IT immediately. You will not be in trouble for flagging something that turns out to be harmless.
  • Think before you share. Personal details shared on LinkedIn, email signatures, and social media can be used to craft highly convincing, personalized attacks.

The Bottom Line

Cybercriminals have concluded that it is far easier to trick a person than to break through modern security software. Your awareness is the single most effective defense your organization has. When in doubt, pause, verify, and report. No legitimate request will ever require you to bypass a security process, and anyone who tells you otherwise should be treated as a red flag, not a reason to hurry.

Sources

Notes

  1. Guardz. “25 Social Engineering Statistics That MSPs Should Know About in 2026.” https://guardz.com/blog/25-social-engineering-statistics-that-msps-should-know-about-in-2026/
  2. Verizon. 2026 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/
  3. Kymatio. “Phishing Trends 2026: AI-Phishing, QRishing & Voice Deepfakes.” https://kymatio.com/blog/phishing-trends-ai-phishing-qrishing-and-voice-attacks
  4. BBC News. “Hong Kong company loses HK$200 million in deepfake video conference scam.” February 2024.
  5. CISA. “Avoiding Social Engineering and Phishing Attacks.” https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks

Policy 114 attribution (AI system: Claude; reviewer: Ryan Wilson, Technology and Business Systems Coordinator)

enduris flame grey

CONTACT US TODAY