What Is Social Engineering in Cybersecurity?
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
Social engineering is the use of psychological manipulation to trick people into revealing information or taking actions that compromise security — rather than exploiting technical vulnerabilities. Phishing is the most common form, but attacks also include vishing (voice calls), smishing (SMS), and pretexting (fabricated scenarios). AI is making social engineering more convincing and harder to detect. The primary defences are staff awareness training and strict verification procedures for sensitive requests.
Key Points
What you need to know.
The Short Answer
21% of businesses that experienced a breach reported a negative outcome such as loss of money or data.
For UK Businesses
7% of businesses that experienced a breach reported temporary loss of access to files or networks — up from 4% in 2024.
Cost Considerations
The NCSC handled 429 total incidents in 2025, with 204 classified as nationally significant — the highest-ever number.
Next Steps
What you should do with this information.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
The main types are phishing (fraudulent emails), vishing (voice calls impersonating IT support or banks), smishing (malicious SMS messages), pretexting (fabricated scenarios to extract information), baiting (leaving infected USB drives), and tailgating (physically following authorised staff into secure areas). With 85% of businesses that experienced a breach identifying phishing as the vector (DSIT 2025), email-based social engineering remains the most prevalent form.
Effective defences combine regular staff awareness training, simulated phishing campaigns, strict verification procedures for financial requests, and technical controls like email filtering and MFA. Establishing a culture where staff feel comfortable reporting suspicious contacts without blame is critical. BEC attacks increased 33% in 2025 (FBI IC3 Report), and organisations with formal verification procedures for payment changes are significantly less likely to fall victim.
Social engineering exploits human psychology — trust, urgency, authority, and helpfulness — rather than technical vulnerabilities. Even well-trained staff can be deceived by sophisticated pretexts, particularly when attackers research their targets using LinkedIn and company websites. The average cost of the most disruptive breach is £3,550 (DSIT 2025), and social engineering is the initial access method behind the majority of these incidents.
Related Questions
What Is Phishing?
Phishing is the most common social engineering attack — how it works and how to defend against it.
Email Security and Phishing Protection
Advanced email filtering that blocks social engineering attempts before they reach your staff.
Cybersecurity Guide for UK SMEs
How staff awareness training and technical controls work together to defend against social engineering.
Protect your business → Get Cybersecurity Assessment