Human factors & social engineering

People are not the weakest link. They are the most targeted one.

29 sketches

• QR phishingA route round the back
• Authority biasBorrowed authority skips the check
• Business email compromiseIt attacks the process, not the machine
• Consent phishingYou let it in, and it is still in
• DeepfakesStop trusting the face
• Help-desk social engineeringThe other way in
• Out-of-band verificationUse the number you already had
• PhishingOne borrowed name, thousands of letters
• PretextingShaped like your normal day
• Reporting cultureSilence is the expensive part
• Security awarenessA net, not a lecture
• Security fatigueThe fortieth prompt
• Shoulder surfingNothing was hacked. It was in shot
• Spear phishingBaited with your own details
• TailgatingOne beep, five people
• UrgencyThe detour that got closed
• Usable securityThe path they actually take
• 'password sticky notes are always bad'The threat is not in your kitchen
• 'humans are the weakest link'The rail is the control
• Phishing exploits context, not stupidityIt fitted the gap
• A warning ignored every day stops being a warningThe bell nobody hears
• Security friction moves behaviour elsewhereSqueeze it here, it comes out there
• MFA fatigue weaponises repetitionAsk forty times
• Verify suspicious requests through a separate channelRing back on a line they never gave you
• People need a safe way to report mistakes quicklyThe shortest road back
• Security training decays without practiceWhat you knew in March
• Authority signals can be forgedBought, not earned
• QR codes hide destinations from casual inspectionThe tag faces away
• Business process controls can beat perfect phishing detectionNobody had to spot it