Social Engineering & Phishing Awareness

Let's think about it this way for a second

Social engineering isn't a technical vulnerability — it's a technique that targets 'people' to trick them into giving up information or access, exploiting psychological principles like trust, authority, and urgency. Phishing is the most common form of social engineering — impersonating a legitimate organization (a bank, company IT) to trick someone into handing over credentials or sensitive information through email or messages. The 'weakest link' in security is often not technology but people — which is why security awareness training is such an important part of an organization's overall security posture.

Let's connect it to a real-world scenario

A phishing email will often use urgency + authority framing, like 'click this link within 24 hours and confirm your password, or your account will be suspended.' Checking the sender's address (which may look like a legitimate domain but has a subtle spelling difference, like paypaI.com vs paypal.com), the link URL (which shows a different destination when you hover over it), and the grammar/urgency tone are all practical techniques for spotting a phishing email.

• Social Engineering = a technique that targets people, exploiting trust, authority, and urgency
• Phishing = the most common form of social engineering (impersonating a legitimate organization)
• Security's 'weakest link' is often people, not technology

Let's look at it together

Phishing email red flags:

[ ] Urgency/fear language ("Act now or your account will be suspended")
[ ] Sender domain that LOOKS right but isn't
    (paypaI.com — capital I instead of lowercase l)
[ ] Link text says one thing, actual URL goes somewhere else
    (hover to check before clicking)
[ ] Requests for password/sensitive info via email
    (legitimate organizations rarely ask this way)
[ ] Generic greeting ("Dear Customer") instead of your real name

You'll be able to identify 5 red flags of a phishing email.