Every year on August 6, International Social Engineering Day reminds us of something that cybersecurity professionals often repeat, yet should never take for granted: most serious security incidents do not begin with a sophisticated exploit, but with a well-crafted deception targeting a person.<\/p>\n\n\n\n
Social engineering is not new, but its ability to operate at scale and with greater precision certainly is. The rise of generative artificial intelligence has fundamentally changed the landscape. Attackers can now create highly convincing fake LinkedIn profiles complete with realistic photos, employment histories, and consistent activity, while maintaining automated conversations over days or even weeks to build trust with their targets. At the same time, cloned websites have become virtually indistinguishable from legitimate ones, and vishing campaigns increasingly rely on AI-generated voices that mimic real executives.<\/p>\n\n\n\n
The result is a far more targeted form of phishing. Modern campaigns are built using publicly available information and leaked data, achieving click-through rates that, according to industry analyses, can be up to four times higher than those of traditional manually crafted phishing campaigns. And email is no longer the only attack vector. Smishing, for example, often achieves particularly high click rates because it bypasses many corporate security controls by targeting employees’ personal devices.<\/p>\n\n\n\n
Global figures reinforce this trend. In 2026 alone, billions of malicious emails are estimated to circulate every day, while the average cost of a data breach originating from a phishing attack has already reached approximately $4.8 million.<\/p>\n\n\n\n
Spain reflects the same pattern. According to Europol’s Threat Assessment Report 2025<\/em>, more than 36% of security incidents reported by European organizations were linked to phishing attempts or attacks, representing an 18% increase compared to 2024. Meanwhile, the threat landscape continues to expand, with an increasing number of attacks beginning through conversations on WhatsApp, LinkedIn, or Telegram, where cybercriminals establish trusted relationships before launching the actual fraud.<\/p>\n\n\n\n As this threat landscape has evolved, people-centric security technologies have had to evolve just as quickly. This is where platforms such as Proofpoint have established themselves as industry leaders. Their approach is based on an increasingly evident reality: modern attacks are no longer primarily designed to bypass firewalls\u2014they are designed to exploit human trust and behaviour.<\/p>\n\n\n\n For this reason, their solutions go far beyond traditional email filtering. They analyse user behaviour, communication context, and the relationships between senders and recipients to detect anomalies that conventional security filters would likely miss, such as a recently registered domain impersonating a trusted supplier, an unusual conversation pattern, or an executive impersonation attempt.<\/p>\n\n\n\n Today, this technological layer has become essential. It detects threats that previously went unnoticed, automates response processes, and provides security teams with valuable time to react\u2014capabilities that simply did not exist a few years ago.<\/p>\n\n\n\n This brings us to what we believe is the most important point of all: no matter how advanced technology becomes, the final decision\u2014whether to open an attachment, click on a link, or approve an urgent payment request\u2014is still made by a person. Security awareness is not simply an addition to a cybersecurity strategy against social engineering; it is one of its fundamental pillars.<\/p>\n\n\n\n An employee who can recognize the warning signs of a manipulation attempt effectively becomes a detection sensor that no technology can fully replace. Conversely, even the most advanced protection platform loses much of its effectiveness if an organization’s security culture is weak. This is why continuous security awareness training, regular phishing simulations, and a workplace culture where employees feel comfortable reporting mistakes or suspicious activity without fear of blame remain, year after year, among the cybersecurity investments with the highest return.<\/p>\n\n\n\n The evolution of social engineering demonstrates that protecting organizations is no longer just about strengthening technological infrastructure. It also means understanding how attackers operate and equipping people with the knowledge and tools they need to recognize and stop fraud attempts before they succeed.<\/p>\n\n\n\n At NEVERHACK, we work alongside Proofpoint to help organizations strengthen their protection against people-centric threats by combining specialized security technology with a continuous strategy of security awareness and improvement.<\/p>\n\n\n\n Because the most effective defence against social engineering does not rely on a single solution, but on the combination of technology, processes, and people prepared to respond to an ever-evolving threat landscape.<\/p>\n","protected":false},"excerpt":{"rendered":"Technology against the new generation of social engineering<\/strong><\/h2>\n\n\n\n
Security awareness as a cornerstone of cybersecurity<\/strong><\/h2>\n\n\n\n
NEVERHACK and Proofpoint: working together to protect people<\/strong><\/h2>\n\n\n\n