Missiora
Social Engineering & Human Risk

Technology Fundamentals

Social Engineering & Human Risk

1 min readPublished 22 Jul 2026

Track your progress. Sign in to mark this guide complete and build your Job Readiness Score.

People are the most targeted part of any system. Social engineering manipulates human trust to bypass technical controls.

Interactive explainer

Social Engineering

Attacking the human, not the machine.

1Phishing2Pretexting3Baiting & Vishing4Defence

Tap or hover a part to learn more.

Phishing

Mass deceptive email.

Fraudulent emails/messages sent widely to trick people into revealing credentials or running malware. Spear phishing targets an individual; whaling targets executives.

Check your understanding

1. What distinguishes spear phishing from phishing?

2. Which single control most reduces the impact of stolen credentials?

Keep learning

Social Engineering & Human RiskIdentity & Access Management CompTIA Security+
Practise this in AI Interview™

The techniques

  • Phishing (mass), spear phishing (targeted) and whaling (executives) — deceptive emails/messages.
  • Pretexting (a fabricated scenario), baiting (a lure like a USB drive) and vishing (voice/phone).
  • Attacks exploit urgency, authority and fear — recognising these cues is the best defence.

Many intrusions start here, then follow the cyber kill chain:

Interactive explainer

The Cyber Kill Chain

The seven stages of an intrusion — and where you can break it.

1Reconnaissance2Weaponization3Delivery4Exploitation5Installation6Command & Control7Actions on Objectives

Tap or hover a part to learn more.

Reconnaissance

Research the target.

The attacker gathers information — emails, technologies, employees, exposed services — via OSINT and scanning. Defence: minimise public exposure, monitor for scanning.

Check your understanding

1. Blocking a malicious email attachment disrupts which stage?

2. Egress filtering and DNS monitoring most directly disrupt which stage?

Keep learning

Threats, Attacks & VulnerabilitiesSecurity Operations CompTIA Security+
Practise this in AI Interview™

Defences: awareness training, MFA (so stolen passwords aren't enough), email filtering and a strong reporting culture. This connects to IAM and Security+.

Interview Intelligence

How this topic actually shows up in interviews — and how to demonstrate you understand it.

Why employers ask about this

Human risk causes most breaches, so employers value candidates who understand and counter it.

Technical questions
How would you reduce phishing risk in an organisation?+

Layer awareness training, MFA, email filtering and simple reporting, then measure with simulations.

Behavioural questions
Tell me about spotting or reporting something suspicious.+

Show noticing the cues (urgency, odd sender) and doing the right, prompt thing.

Real-world scenarios
“An employee reports clicking a suspicious link.”+

Expected answer: Thank them, isolate/reset as needed, check for compromise, and treat it as an incident — never blame.

Practise in AI Interview™Rehearse these questions, scored.Plan with Career Coach™A personalised path to your goal.Evidence it in Career Passport™Prove this skill to employers.

Employability Intelligence

Where this knowledge takes you — the jobs, skills and certifications it feeds into.

Relevant roles
SOC AnalystSecurity Awareness LeadSecurity Engineer
Skills you're proving
Phishing defenceHuman riskAwareness
Recommended certifications
CompTIA Security+CompTIA CySA+CompTIA PenTest+
Career progression

Cyber Fundamentals → Security+ → SOC/Security.

What employers expect

That you understand core security principles and can apply them to real risks, controls and incidents.

Frequently asked questions

What is social engineering?

Manipulating people into revealing information or taking unsafe actions, bypassing technical controls.

What is the difference between phishing and spear phishing?

Phishing is mass and generic; spear phishing is targeted and personalised to a specific victim.

How do you reduce human risk?

Awareness training, MFA, email filtering and an easy, blame-free way to report suspicious messages.

Related guides

Cyber Security Fundamentals: Principles, Threats, Defence & OperationsSecurity Principles: CIA, Defence in Depth & Zero TrustRisk Management & GovernanceThreat Actors & Threat Intelligence

Practise what you've learned

Turn this guide into real, evidenced progress

Missiora helps you measure, improve and evidence the capabilities employers actually value — start with the tools best suited to this topic.

M
Published by
Missiora

Missiora is an AI Employability Intelligence platform. Our resources are researched and reviewed by the Missiora team to help you measure, improve and prove your career readiness.

All resources