The gate was already open¶

Technical controls have a reasonably well-defined threat model. Social engineering does not, because the attack surface is every person in the organisation who answers a phone, opens an email, holds a door, or clicks a link while eating lunch.

Techniques using physical presence and digital lures share a structural advantage: they mostly exploit behaviour that is, in any other context, entirely reasonable.