How do you defend employees as social engineering evolves?

Defend employees by assuming some messages will fool them and designing around it: phishing resistant sign in so stolen passwords fail, a rule to verify unusual requests through a second channel, and a no-blame way to report. Awareness training helps, but controls do the heavy lifting.

What has changed about social engineering?

CISA's guidance on recognizing phishing used to lean on poor grammar and misspellings as clues. It now says that in the era of artificial intelligence some emails will have perfect grammar and spelling, so people should look out for the other signs: urgency, requests for personal or financial information, untrusted shortened links and addresses that are slightly wrong, such as a swapped letter in a brand name.

The message is that style is no longer a reliable test. Behavior is: unexpected, urgent, asks for credentials or money.

What is the simplest habit that works?

CISA's phishing guide gives three steps: recognize, resist and report or delete. If a message could be real, do not click a link or call a number in it. Look up the company or person through another route, such as a known website or phone number, and confirm there.

That is out of band verification. For finance teams, make it policy: any change of bank details or urgent payment is confirmed by calling a number already on file.

Why does the type of MFA matter?

CISA's fact sheet says MFA makes it harder for attackers if passwords are compromised, but not all forms are equally secure. Some are vulnerable to phishing, push bombing, SS7 weaknesses and SIM swapping. Phishing resistant MFA is, in its words, the most secure form, and CISA strongly urges organizations to implement it as part of applying zero trust principles.

If an employee types a code into a fake page, an attacker can replay it. Phishing resistant methods are bound to the real site, so the fake page gets nothing.

What does the CISA ransomware guide add?

It recommends user awareness training that includes how to identify and report suspicious activity, flagging external emails, gateway filters for known malicious indicators and strong controls on remote access. It also notes more sophisticated forms of social engineering have been added to its recommendations.

A constructed example

An accounts payable clerk receives an email that looks like it comes from a supplier, asking to update bank details before the next payment. The grammar is flawless. Because the policy says changes need a callback to the number on file, the clerk calls, the supplier says nothing was sent, and the clerk reports it. The message is deleted from every inbox within the hour.

No awareness slide stopped it. A process did.

What about voice calls and messaging apps?

Social engineering is not limited to email. CISA's guidance says if you get a strange message from a friend on a social platform and you have their number, text or call to ask whether they sent it. The same logic applies at work: if a chat message from an executive asks for gift cards or a payment, confirm through another channel.

Your policy should name the channels. "Email" is too narrow when requests arrive by chat, text, phone or video.

How do you train without boring people?

Short beats long. A five minute session using one real looking message and asking "what would you do next" teaches more than a yearly hour of slides. CISA's own example describes a busy professional who clicked because the message created urgency and the website looked right. Use stories like that and finish each with the one action that would have stopped it.

Give new hires and finance staff targeted material, since they are asked for money and credentials most often. Track whether people report, not only whether they click, because a high reporting rate gives your security team the earliest warning you will get.

How to check or apply this

1. Move administrators and finance staff to phishing resistant MFA first.
2. Write a callback rule for bank detail changes and unusual requests.
3. Add a visible report button and thank people who use it.
4. Flag external email and filter known malicious indicators.
5. Teach by example: run short sessions using real messages with perfect grammar.
6. Limit what a single compromised account can reach.
7. Measure reporting rate and time to remove, not only click rate.
8. Review incidents without blame and update the process.

Quick check

Sources

1. CISA, Recognize and Report Phishing
2. CISA, Implementing Phishing-Resistant MFA (Oct 2022)
3. CISA, #StopRansomware Guide

Last reviewed: 18 October 2026.