Social engineering¶
Technical controls have a reasonably well-defined threat model. Social engineering does not, because the attack surface is every person in the organisation who answers a phone, opens an email, holds a door, or clicks a link while eating lunch.
The techniques here span physical presence, digital lures, and credential theft, and they share one structural advantage: they mostly exploit behaviour that is, in any other context, entirely reasonable.
