InfoSight Threat Landscape Series: Social Engineering Will Never Go Away — So Stop Trying to Prevent It

Every technical control you deploy — firewalls, EDR, MFA, network segmentation — is built to defend against machines attacking machines. None of it does much against a convincing voice on the phone, a message from "IT support" in your company chat, or a video call where the CFO's face and voice are both fake.

Social engineering doesn't try to break your systems. It asks your people to open the door, and often, they do.

You don't solve it once and move on. It's a permanent feature of the threat landscape, and in 2026 it's evolving faster than most security awareness programs can keep pace with.

The Human Perimeter Is Under More Pressure Than Ever

A handful of trends are reshaping what social engineering looks like right now:
ClickFix campaigns have surged. These attacks trick users into pasting attacker-supplied commands directly into their own terminal or Run dialog, often disguised as a routine fix for a browser or software error. Campaigns using this technique reportedly grew 517% in a single year — proof that attackers don't need to breach a firewall when they can talk a user into running the payload themselves.

Attacks now span every channel at once. Email, SMS, voice calls, and collaboration platforms like Slack or Teams are increasingly used together in a single campaign, with the same false narrative reinforced across each one. Coordinated multi-channel pressure is significantly harder for an employee to second-guess than a single suspicious email.

Deepfakes have gone from novelty to weapon. The volume of deepfake files circulating publicly grew from roughly 500,000 in 2023 to more than 8 million by 2025. Voice cloning and video impersonation of executives are no longer expensive or rare — they're scalable enough to anchor an entire attack chain.
IT helpdesk impersonation is getting attackers to domain admin fast. Threat actors are posing as internal IT staff over chat tools to request password resets or access changes. One documented case reached domain admin access in under 40 minutes using nothing but a pretext and a helpful employee.
Brand impersonation keeps getting more convincing, using look-alike domains and characters that visually mimic trusted brands to lower a target's guard before the actual ask ever comes.

Why "Prevention" Was Always the Wrong Frame
Security programs that treat social engineering as something to prevent — one more box to check with an annual training video — consistently underperform against attackers who treat it as their most reliable entry point. You cannot patch judgment under pressure. You can only build it.

That's the shift toward resilience: preparing people to recognize and respond to manipulation in the moment, under the same time pressure and emotional framing a real attacker would use — not just to recall a policy weeks after a training module.

What Resilience Looks Like in Practice

• Simulate, don't just educate. Employees who've experienced a realistic phishing, vishing, or pretexting attempt in a controlled setting respond faster and more accurately to the real thing than employees who've only read about one.
• Test the full human perimeter, not just email. Voice (vishing), SMS/collaboration tools (smishing), and physical access (tailgating, badge cloning) all need their own testing — attackers aren't limiting themselves to inboxes.
  Score susceptibility by team and role, not just company-wide. Finance, HR, and IT helpdesk staff face fundamentally different pretexts and need tailored preparation.
• Close the loop with physical security. Social engineering increasingly bridges digital and physical — a cloned badge or a talked-past receptionist can be as damaging as a phished credential.
• Report on human risk the way you report on technical risk — trends over time, mapped to the compliance frameworks your board and auditors actually care about.

How InfoSight Helps

InfoSight's Social Engineering & Physical Security Testing service was built around exactly this shift. Our red-team professionals run realistic phishing, vishing, smishing, and in-person intrusion simulations — including badge cloning, tailgating, and physical breach drills — using the same AI-enhanced deception techniques (deepfakes, custom look-alike domains) that real adversaries now use. You get employee susceptibility scores by role and location, a physical security gap analysis, and a tailored training roadmap, all mapped to NIST 800-53, ISO 27001, and HIPAA human-control requirements, and tracked over time in our Mitigator® platform.

Your people are already being tested by attackers. Book a scoping call and find out how they'd hold up — before it's not a simulation.