Inside Social Engineering

Explore the topics

Four ways into the human side of security.

These sections organize the published articles. The boundaries overlap: a single interaction can involve authority, access and money at the same time.

Human behavior ↗

How pretexts, urgency and authority change the way a request is evaluated.

When a conversation moves channels, trust should not move automatically
A QR code moves the trust decision onto a different screen
Knowing your first school is not the same as being you
One more step to recover everything: the trap inside a nearly finished process

Identity & access ↗

The distinction between a familiar identity, authenticated access and legitimate permission.

The login page is real. The device you are authorizing might not be yours
The dangerous part of a consent screen is what comes after “Allow”
Why changing a password may not finish an account takeover response
A browser notification is not a diagnosis of your computer

At work ↗

Practical design of help-desk verification, escalation and reporting.

The invoice can be genuine and the bank details wrong
Payroll changes deserve more than a familiar name in an inbox
A lower phishing click rate can still tell the wrong story
The boss wants an exception: designing a process that can survive authority

News analysis ↗

Primary-source developments interpreted for people, not just security tools.

A CAPTCHA should not need your terminal: the boundary ClickFix tries to erase
First the inbox floods. Then “IT support” arrives in Teams
The interview is not the sandbox: when a coding test becomes a security decision
A guest complaint, a trusted service, and a file that is not just a photo