# Why Social Engineering Beats Your Security Stack > You can buy every control on the market and still lose to a polite phone call. Here is why the human layer keeps deciding breaches, and what actually changes the outcome. - URL: https://www.awarexone.com/research/why-social-engineering-beats-your-security-stack - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026 (updated 2026-09-28) - Topics: Social engineering, Human risk - Related service: Social engineering and training: https://www.awarexone.com/services/social-engineering ## Short answer Social engineering targets the decisions people make, such as approving a payment or resetting access, so your security tools often have no reason to block it. MFA still blocks most password attacks, but attackers can also target help desks and recovery channels. Replace vague advice with specific rules: call back on a known number and require a second approver. ## Summary - Social engineering targets the decisions people make, such as approving a payment or resetting access, so security tools often have no reason to block it. - MFA still blocks most password attacks, but attackers can target prompts, codes, help desks and recovery channels, so reset procedures need rules too. - Replace vague advice with specific rules: call back on a known number, and require a second approver for unusual payments or bank-detail changes. - Make reporting easy and never punish people who report a mistake, because every hour of delay gives an attacker more time. - If money is lost, contact your bank or the National Scam Response Centre on 997 immediately, then preserve evidence and review the process. - Testing staff must be authorised in writing and scoped, and the goal is to fix weak processes, not to catch or embarrass employees. Picture a Malaysian company with a sensible security budget. MFA on every account. Endpoint detection on every laptop. Email filtering, a SIEM, conditional access, a firewall someone actually maintains. On a Thursday afternoon, the finance executive gets a WhatsApp message from the managing director: are you in the office? A few minutes later comes a call about a confidential acquisition, a supplier who must be paid today, and a request to keep it quiet until the announcement. The request sounds plausible. The executive makes the transfer. No alert fires, because nothing technically abnormal happened: an authorised person used an authorised system to do something they are allowed to do. The security stack did not necessarily fail. The attacker found a path through trust and process instead of through the technology. That is not the only way breaches happen, but it is a common one, and it needs a different kind of defence. Last checked: 28 September 2026. ## Why Does Social Engineering Still Work When a Company Has Strong Security? Security controls mainly protect systems, identities, endpoints, networks and data flows. Social engineering targets the decisions people make around those systems. A person may approve a request, disclose information, reset someone's access, click a link, approve an MFA prompt, trust a phone call, or skip a normal process because it feels urgent. Each of those actions can be legitimate, so the technology often has no reason to block it. Social engineering targets people and processes rather than relying only on technical vulnerabilities. The lesson is not that the tools are useless: strong technology lowers risk, and good human and business processes close the trust gaps that remain. ## 1. What Is the "Human Layer" in Cybersecurity? The human layer is every point where a person makes a security-relevant decision: - Approving payments, access requests and exceptions. - Authenticating: entering codes, approving prompts, enrolling devices. - Help-desk interactions, including password and MFA resets. - Administrative changes to accounts, suppliers and payroll. - Handling sensitive information and deciding who may see it. - Responding to unusual requests. - Reporting, or not reporting, something that felt wrong. People are not simply a weakness bolted onto a secure system. They are part of the system, doing jobs the system depends on. People are not inherently the weakest part of security; they are one of the attack surfaces threat actors deliberately target. That framing is more useful, because it points to things you can design: workflows, approval rules and verification steps. ## 2. How Social Engineering Gets Around Technical Controls *Where social engineering can exploit gaps around controls* | Technical control | What it protects | How social engineering may work around it | | --- | --- | --- | | MFA | Authentication | The user is persuaded to approve a prompt or disclose a code | | Email filtering | Malicious email | The attack moves to phone, SMS, chat or a trusted service | | EDR | Endpoint behaviour | The attacker first persuades the user to take an action that looks legitimate | | Identity controls | Account access | The attacker targets the recovery or help-desk process | | Payment controls | Transactions | The attacker manipulates the person requesting or approving the payment | | Security monitoring | Technical activity | A human-performed action may look normal until the consequence appears | None of these controls is bypassed every time. Each one removes whole categories of attack. The point is that each protects something specific, and a determined attacker will look for the step next to it that a person controls. ## 3. The Most Powerful Weapons Are Often Context, Not Malware Attackers do not always need a zero-day, malware or a stolen database. Sometimes they need the right name, the right timing, the right authority and the right story. Most of that can be assembled from public sources: company websites, LinkedIn, press releases and staff posts. Our piece on [how attackers research your company](https://www.awarexone.com/research/osint-how-attackers-research-your-company) shows how much is available. The story is called a pretext. Pretexting is creating a plausible story or identity to persuade someone to reveal information, grant access or perform an action. Verizon's [2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T158/reports/2026-dbir-data-breach-investigations-report.pdf) describes it as a trusted relationship "built through concocted scenarios to trick the user into taking an action that unknowingly compromises the organization, frequently by voice communications but also seen via email or text messaging". How common is this? The 2026 DBIR analysed more than 22,000 confirmed breaches across 145 countries, from incidents between 1 November 2024 and 31 October 2025. It found the human element in 62% of those breaches, social engineering as the third most common breach pattern at 16%, and pretexting in 6% of all breaches. Those figures describe breaches in Verizon's dataset, not every organisation, and "human element" includes honest mistakes as well as manipulation. ## 4. Why Authority and Urgency Work Social engineering uses ordinary workplace pressures: - Authority: "The CFO asked for it." - Urgency: "This has to go out in the next five minutes." - Familiarity: "It's your usual supplier. Our bank details changed." - Fear: "Your account will be disabled today." - Secrecy: "Don't involve the rest of the team yet." - Reciprocity: "I helped you last time. Just send me the code." These cues work because in a healthy organisation they are usually genuine. Senior people do make urgent requests. Suppliers do change banks. Under time pressure and with a full inbox, the careful step of checking independently is the one that gets squeezed out. That is a normal human response to workload and hierarchy, not a character flaw. Our article on [the six psychological levers social engineers use](https://www.awarexone.com/research/six-psychological-levers-social-engineers-use) goes deeper. ## 5. Why MFA Doesn't Solve Social Engineering by Itself MFA works. Microsoft's [Digital Defense Report 2025](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/bade/documents/products-and-services/en-us/security/Microsoft-Digital-Defense-Report-2025.pdf) says it "still blocks over 99% of unauthorized access attempts". If you do not have it, turn it on. MFA reduces the risk of password-only compromise, but social engineering can target the authentication and recovery workflows around it: - Password and code phishing: a fake login page collects the password and the one-time code together. NIST's [SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) says authenticators that involve manually entering a code "SHALL NOT be considered phishing-resistant". - MFA fatigue, or push-bombing: CISA describes an attacker sending repeated push notifications "until the user either approves the request by accident or out of annoyance". Number matching is CISA's interim mitigation. - Device-code phishing: the user is persuaded to enter a code that signs the attacker's device in. Microsoft reported a sharp rise in these events in its 2025 report. - Help-desk manipulation: the attacker asks support to reset MFA or enrol a new device. Microsoft reports ransomware operators using vishing and help-desk themed social engineering, including over Teams, to obtain or reset credentials. - Recovery-channel compromise: if the recovery email or phone number is weaker than the account, the attacker targets that instead. Phishing-resistant MFA closes the first gap. NIST defines phishing resistance as preventing secrets from reaching an impostor "without relying on the vigilance of the claimant", and CISA calls FIDO/WebAuthn, such as passkeys and hardware security keys, "the only widely available phishing-resistant authentication". It does not fix a help desk that resets MFA for anyone who sounds convincing. That needs a process. ## 6. Why a Phone Call Can Be More Dangerous Than an Email Email gives the target time. They can reread it, hover over a link, forward it to IT. A live call removes that time. It adds immediacy, emotion, a voice that can answer questions, and the social awkwardness of saying "I need to call you back" to someone who sounds senior. Verizon's 2026 DBIR offers a hint about scale: in simulation data from security-awareness vendors, the median click rate for phone-centric methods such as voice and text was about 2%, against 1.4% for email, roughly 40% higher. Verizon itself calls the sample "small-ish": 35 non-email campaigns against 8,395 email ones. Treat it as a direction, not a precise measurement. The same report notes attackers impersonating help-desk agents, or users needing a password reset, "with moderate levels of success". ## 7. The "Polite Phone Call" Attack A finance executive at a mid-sized Malaysian distributor gets a call from someone who sounds like the managing director. It is polite, a little rushed, and specific: a confidential deal, a supplier to pay, a document to send. They might ask for: - An urgent transfer. - A change to a supplier's bank details. - A confidential document. - Approval of an MFA prompt "so I can get into the system". This is not hypothetical. In July 2026, police in Perak said a company in Ipoh lost RM970,000 after a clerk followed instructions from someone posing as a manager, whose phone police believe had been compromised ([Malay Mail](https://www.malaymail.com/news/malaysia/2026/07/09/company-in-ipoh-loses-rm970000-after-clerk-duped-by-whatsapp-scam-posing-as-boss/226906)). In August, a Kuala Terengganu car dealership lost RM452,000 to a similar "boss" request over WhatsApp ([Malay Mail](https://www.malaymail.com/news/malaysia/2026/08/26/whatsapp-boss-scam-leaves-terengganu-car-dealership-rm452000-poorer/232682)). The answer is not "train harder". The employee recognised the name, and possibly the voice. The answer is to make independent verification part of the workflow, so nobody has to rely on recognition: - Call back on the number already in the company directory, never the one that called. - Require a second approver for payments outside the normal cycle. - Route bank-detail changes through the existing supplier-change procedure, whoever asks. - Ask for written confirmation through an official channel. - Keep a known-contact directory for executives, key suppliers and the bank. ## 8. The Controls That Actually Change the Outcome The strongest programmes combine three kinds of control. Technology: - MFA, moving to phishing-resistant methods where you can. - Endpoint protection and email filtering. - Identity protection and conditional access. - Logging and monitoring, including of help-desk resets and payment changes. Process: - Dual approval for high-value or unusual actions. - Callback verification using known contacts. - Least privilege and regular access reviews. - Payment and supplier-change verification. - Known escalation routes. - Separation of duties, so no single person can request, approve and execute. People: - Scenario-specific training for the roles that are actually targeted. - Realistic, authorised simulations. - A clear, easy way to report. - Reinforcement and coaching. - Psychological safety, so people report early. The goal is not perfect people. The goal is to make dangerous actions harder to perform and safe actions easier to follow. Independent verification is a process control that can reduce fraud from impersonated callers and urgent requests, whoever happens to answer the phone. ## 9. Replace "Be Careful" With Specific Verification Rules Vague advice fails under pressure because it asks for judgement at the worst moment. Specific rules remove the judgement call. *From vague advice to verifiable rules* | Vague advice | Specific rule | | --- | --- | | Be alert for phishing. | Any request to change supplier bank details is verified using a previously known contact channel. | | Never trust urgent requests. | Any urgent payment outside the normal workflow needs a second approver. | | Check the email carefully. | Never use contact details supplied in the message. Use the existing directory. | | Be careful with MFA. | Never approve a sign-in prompt you did not start. Report it. | | Help users quickly. | The help desk resets MFA only after verification through a documented method, never on the caller's word. | | Watch out for fake bosses. | Executives never ask staff to skip a control, and staff are expected to verify any request that does. | | Protect sensitive data. | Payroll, bank or HR data is sent only through the approved system, never in reply to a request. | A rule that applies to the CEO exactly as it applies to a new hire also removes the social cost of saying no. Nobody has to be brave to follow a policy. ## 10. Make Reporting Easier Than Hiding a Mistake If people fear punishment, embarrassment or blame, some will delay reporting, and every hour of delay gives an attacker more time. You want to hear "I clicked the link and reported it straight away", not "I clicked it and hoped nobody noticed". That makes reporting a success, not a confession. Thank the reporter publicly where appropriate, keep the reporting channel to one click or one message, and respond quickly so people see it matters. MyCERT's recommendations for organisations include establishing verification procedures and awareness so staff know what to do with a suspicious request; a reporting route is the other half of that. ## 11. Security Awareness Training Often Fails for a Simple Reason Training is not the problem. The format usually is: annual slide decks, generic phishing quizzes, scenarios that match nobody's actual job, no reinforcement, no measurement of behaviour, and simulations used to punish. NIST's [SP 800-50 Rev. 1](https://csrc.nist.gov/pubs/sp/800/50/r1/final) (September 2024) frames learning programmes around behaviour change as part of risk management, with role-based training for people with significant security responsibilities and metrics that track behaviour over time. In practice that means: - Role-specific content: finance learns payment fraud, IT learns help-desk pretexts. - Realistic scenarios drawn from real incidents. - Short, repeated exercises rather than one long session a year. - Coaching at the moment of the mistake. - A positive reporting culture. - Measured outcomes, not completion certificates. Security awareness is more useful when procedures make the safe behaviour practical. We make the longer argument in [why security awareness training is broken](https://www.awarexone.com/research/security-awareness-training-is-broken). ## 12. Why Realistic Simulations Matter A controlled simulation shows what policy documents cannot: - Who verifies requests, and who does not. - Who reports suspicious activity, and how quickly. - Which processes are routinely bypassed. - Where approval chains break under pressure. - Which roles are most exposed. - Whether people know how to escalate. Testing must be authorised in writing, scoped, proportionate, safe and documented. Surprise tests outside an agreed programme can cause real harm, damage trust and may be unlawful. The aim is to learn how the organisation behaves, not to trick individuals. ## 13. What AwareXone Means by Human-Layer Security AwareXone runs [authorised social-engineering testing and training](https://www.awarexone.com/services/social-engineering): written-scope simulations of the attacks staff are likely to face, across email, voice, SMS, callback and deepfake scenarios, followed by coaching and workshops. Depending on scope, that can include spear phishing, vishing, smishing, callback phishing, help-desk pretexts and authorised voice-cloning and deepfake video call scenarios. Every engagement runs on written authorisation, an agreed scope and scenarios, and an emergency stop contact, and reports do not name individuals. Nobody outside the agreed scope is tested. The sequence is test, observe, coach, improve. ## 14. The Goal Is Not to Catch Employees A simulation should find weaknesses in the system, not produce a list of people to embarrass. The useful questions are about design: - Was the process easy to bypass? - Was a verification route available and practical? - Did the employee know where to report? - Did a manager's behaviour create pressure to skip steps? - Was the policy realistic for the job? - How quickly did the team notice and recover? The best result is a more resilient organisation, not a leaderboard of who clicked. ## 15. Social Engineering Risks by Department Different teams face different pressures. These are general patterns, not a claim that every department carries the same risk: *Common pressures and matching controls by team* | Team | Typical pressure | Useful control | | --- | --- | --- | | Finance | Urgent payment or bank-detail change | Dual approval and independent callback | | IT and help desk | Caller claiming to be an employee needing a reset | Documented identity verification before resets | | HR | Fake employee, onboarding or payroll change | Independent identity checks through known records | | Executives | Authority-based pretexts, fake board members or advisers | An executive verification protocol everyone knows | | Sales | Fake customer or partner seeking information | Verification before sensitive disclosure | | Marketing | Fake brand, agency or sponsor | Domain and identity verification | | Customer support | Fake internal escalation | Known internal channels only | | Creators | Fake sponsorship, management or platform support | Independent brand verification | ## 16. A Simple Social-Engineering Resilience Framework - Stop: pause when a request is unusual, urgent or high-consequence. - Verify: use an independently known channel, not the one the request came through. - Escalate: involve another trusted person when the request matters. - Record: document suspicious approaches and near misses. - Learn: use each incident to improve the process. This is a behaviour and process framework, not a product. It works because each step is small enough to do under pressure. ## 17. What Executives Should Change - Remove unnecessary urgency from internal culture. If everything is urgent, urgency stops being a warning sign. - Follow approval policies personally, visibly. - Thank people who verify you. Never punish a callback. - Never ask staff to bypass a control, even informally. - Encourage reporting, including of your own mistakes. - Take part in realistic exercises; executives are frequent targets. - Review repeated social-engineering incidents as process failures. - Measure response quality, not just click rates. MyCERT's [boss impersonation alert](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026) (May 2026) describes emails sent mainly to executives' personal Gmail addresses, opening with "Are you in the office?" and exploiting "authority, trust, and a sense of urgency" to obtain sensitive information. Its first recommendation is to verify requests through alternate channels. ## 18. What SMEs Can Do Without Buying More Security Products 1. Write a one-paragraph payment verification rule and share it. 2. Create a trusted contact list for executives, key suppliers and your bank. 3. Require callbacks for sensitive requests. 4. Separate who requests, approves and pays. 5. Remove admin access nobody needs. 6. Turn on MFA everywhere, and passkeys where offered. 7. Secure business email, including SPF, DKIM and DMARC, which MyCERT recommends. 8. Create one reporting channel, such as a dedicated chat group or email. 9. Rehearse three to five realistic scenarios as a team. 10. Review near misses and lessons monthly. ## 19. Metrics That Actually Matter Click rate alone is a weak measure; it rewards easy simulations. Better measures: - Time to report a suspicious request. - Share of high-risk requests independently verified. - Time to revoke compromised access. - Share of staff following escalation procedures. - Repeat-failure rate for the same scenario. - Simulations that went unreported. - Rate of immediate reporting after a mistake. - Time from discovery to containment. Use metrics to improve systems, not to punish individuals. A number that gets people punished will soon stop being reported honestly. ## 20. How to Measure Whether Training Actually Changed Behaviour 1. Before: run a baseline scenario. 2. During: observe decisions, not just outcomes. 3. Immediately after: coach people on what happened. 4. Later: repeat comparable scenarios. 5. Compare verification, reporting, escalation, response speed and repeat errors. Simulations do not perfectly predict real behaviour, but repeated measurement over time shows whether the organisation is moving in the right direction. ## 21. What to Do After a Successful Social-Engineering Incident 1. Stop the attack path: halt the payment, block the sender, end the session. 2. Secure affected accounts. 3. Revoke unauthorised access. 4. Reset compromised credentials. 5. Review sessions and devices where relevant. 6. Check financial and data exposure. 7. Preserve evidence: messages, call logs, emails and transaction records. 8. Notify the right internal teams. 9. Report externally where appropriate: your bank and the National Scam Response Centre on 997 for money lost to fraud, and [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview) for cyber incidents. 10. Review the process that allowed the action. 11. Update controls. 12. Coach based on the actual failure, not generic retraining. Speed matters most with money. Bank Negara Malaysia advises scam victims to [contact their financial institution or NSRC at 997 immediately](https://www.bnm.gov.my/-/nfp-launch). ## 22. Why Better Security Is Not "More Security Tools" When something goes wrong, the reflex is to buy another tool. Sometimes that is right. Often the missing control is a callback, a second approval, a known contact, a clear escalation path, a better recovery process or a safer reporting culture. None of those appears on an invoice. Security maturity is not the number of products deployed. It is how reliably the organisation makes good decisions when someone is trying to push it into a bad one. ## 23. The New Reality: AI Makes Social Engineering More Convincing AI improves an attacker's speed and credibility. Personalised phishing can be written at scale in fluent English, Malay or Chinese. Synthetic voice and deepfake video can imitate a known person. A study cited in Microsoft's 2025 report found AI-automated phishing emails achieved a 54% click-through rate against 12% for standard ones, in a controlled experiment. The FBI's [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 24,768 business email compromise complaints in the US, with reported losses of about US$3.05 billion, and more than US$30 million in BEC losses involving AI. AI does not make every attack undetectable. It does make surface cues such as bad grammar or an unfamiliar voice less reliable, which makes verification processes more important. Our guides on [AI voice cloning attacks](https://www.awarexone.com/research/ai-voice-cloning-attacks) and [verifying a suspicious video call](https://www.awarexone.com/research/deepfake-video-call-verification) cover the defences. ## 24. What Malaysian Businesses Should Change Now For current context: CyberSecurity Malaysia's [Cyber999 Q2 2026 summary](https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16) recorded 2,715 incidents reported to its response centre, with fraud making up 85.23% (2,314 incidents), most of it phishing. That dataset only covers incidents reported to Cyber999, not all cybercrime in Malaysia. It also describes callers impersonating police, LHDN, MCMC, banks and companies to pressure people into revealing information. A practical checklist: - MFA on every business account. - Protected business email, with SPF, DKIM and DMARC. - Callback verification using known contacts. - Written approval rules for payments. - One staff reporting channel. - Phishing and vishing awareness built on local examples, including WhatsApp. - Finance verification for every payment change. - An executive verification protocol. - Vendor bank-change verification. - An incident response plan with NSRC 997 and your bank's fraud line. - Authorised simulations, where they fit your risk. ## 25. What Creators and Public-Facing People Should Change - Verify sponsorship requests through the brand's official channels. - Verify any urgent money request by calling the person on a known number. - Protect your email with a unique password and MFA. - Enable MFA on every platform. - Keep a list of trusted contacts for your team and family. - Watch for accounts impersonating you. Our [impersonation evidence guide](https://www.awarexone.com/research/impersonation-removal-malaysia) explains what to save. - Never share security codes with anyone. - Use separate channels for business and personal contact. - Document suspicious approaches. - Brief your team and family on what you will never ask them for. For public-facing people, account security and identity are the same problem. Our [digital identity protection](https://www.awarexone.com/digital-identity-protection) work covers that side. ## 26. When Professional Human-Layer Security Testing Makes Sense Not every organisation needs a simulation. Authorised testing may help when: - You have had repeated social-engineering incidents. - Staff handle significant financial actions. - Help-desk processes are high risk. - Executives are frequent targets. - The company is scaling quickly. - Remote and mobile work increases exposure. - Awareness training has not changed behaviour. - Leadership wants evidence of how processes hold up under pressure. ## How AwareXone Approaches the Human Layer AwareXone is a Malaysian security company. Our social-engineering work is authorised testing and training: written authorisation, agreed scope and scenarios, an emergency stop contact, and reports that do not name individuals. Scenarios can cover spear phishing, vishing, smishing, callback phishing, help-desk pretexts and deepfake scenarios, depending on what the engagement covers. The emphasis is test, observe, coach and improve, so that the result is better processes rather than a list of names. We do not promise a particular change in behaviour; we measure it. You can read [how we work](https://www.awarexone.com/trust). ## The 10-Minute Human-Layer Security Check - High-risk requests require independent verification. - Payment changes require a second check. - Employees know where to report suspicious activity. - Help-desk identity verification is documented. - MFA is enabled. - Sensitive recovery processes are protected. - Former employees lose access promptly. - Executives follow the same controls as everyone else. - Staff can report mistakes without fear. - The organisation rehearses realistic scenarios. ## Frequently Asked Questions ### Why does social engineering work even when a company has strong cybersecurity? Because security tools protect systems, while social engineering targets the decisions people make around them, such as approving a payment or resetting access. Those actions can be legitimate, so tools often have no reason to block them. ### Can MFA stop social engineering? MFA blocks most password-based attacks, but social engineering can target MFA prompts, codes, help desks and recovery channels. Phishing-resistant MFA and strong reset procedures close most of those gaps. ### What is the human layer in cybersecurity? It is every point where a person makes a security-relevant decision: approvals, authentication, help-desk resets, payments, handling sensitive data and reporting. ### What is pretexting? Pretexting is creating a plausible story or identity to persuade someone to reveal information, grant access or perform an action, often by phone. ### Why are phone calls and messaging becoming important to social engineering? Live conversations create urgency and let the attacker answer questions, and they avoid email filters. Verizon's 2026 DBIR found higher median click rates for voice and text than email in simulations, though from a small sample. ### Does security awareness training actually work? It can, when it is role-specific, repeated, realistic and backed by procedures that make safe behaviour easy. Annual compliance slides alone rarely change behaviour. ### What should employees do when an executive makes an unusual request? Pause and verify through a known channel, such as calling the executive's number from the directory. Good executives expect this and will thank you for it. ### How should finance teams verify urgent payment requests? Call back on a known number, require a second approver for anything outside the normal cycle, and route bank-detail changes through the existing supplier-change procedure. ### How can SMEs reduce social-engineering risk without buying more tools? Write a payment verification rule, keep a trusted contact list, require callbacks, separate approval duties, remove unneeded admin access, turn on MFA and create one reporting channel. ### What is phishing-resistant MFA? Authentication that cannot be relayed to a fake site, such as passkeys or FIDO2 security keys. NIST does not treat methods where you type a code, like SMS or authenticator codes, as phishing-resistant. ### How can companies test their human-layer security safely? Through an authorised programme with written approval, an agreed scope and scenarios, an emergency stop contact and reporting that focuses on processes rather than naming individuals. ### When is authorised social-engineering testing worthwhile? When you have had repeated incidents, handle significant payments, run a high-risk help desk, have frequently targeted executives, or need evidence that training has changed behaviour. ## Official sources - [Verizon: 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T158/reports/2026-dbir-data-breach-investigations-report.pdf) - [Microsoft Digital Defense Report 2025](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/bade/documents/products-and-services/en-us/security/Microsoft-Digital-Defense-Report-2025.pdf) - [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) - [CISA: Implementing Phishing-Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) - [CISA: Implementing Number Matching in MFA Applications](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) - [NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) - [NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program](https://csrc.nist.gov/pubs/sp/800/50/r1/final) - [NIST glossary: social engineering](https://csrc.nist.gov/glossary/term/social_engineering) - [MyCERT MA-1439.052026: Boss impersonation email alert](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026) - [CyberSecurity Malaysia: Cyber incident quarterly summary, Q2 2026](https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16) - [CyberSecurity Malaysia: Cyber999 overview](https://www.cybersecurity.my/portal-main/services/cyber999-overview) - [Bank Negara Malaysia: National Fraud Portal launch](https://www.bnm.gov.my/-/nfp-launch) - [Malay Mail: Ipoh company loses RM970,000 to WhatsApp boss scam (July 2026)](https://www.malaymail.com/news/malaysia/2026/07/09/company-in-ipoh-loses-rm970000-after-clerk-duped-by-whatsapp-scam-posing-as-boss/226906) - [Malay Mail: WhatsApp boss scam costs Terengganu dealership RM452,000 (August 2026)](https://www.malaymail.com/news/malaysia/2026/08/26/whatsapp-boss-scam-leaves-terengganu-car-dealership-rm452000-poorer/232682) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.