A social engineering framework describes how a manipulation attack unfolds, from the moment an attacker chooses a target to the moment they walk away with credentials, money, or account access. These attacks exploit ordinary decisions under believable pressure, often before suspicious activity becomes obvious.
Understanding social engineering as a repeatable process rather than a catalog of scams changes what effective defense looks like. Each phase, from target selection to the moment an attacker disengages, leaves distinct openings for controls that hold up even when a convincing request slips past human judgment. This guide explains how a social engineering attack progresses, how its tactics shift across delivery channels, and where defenders can interrupt it.
Key Takeaways
Phased lifecycle models reveal behaviors that a person or security team may interrupt.
Attackers apply psychological levers such as authority, urgency, and familiarity, and these levers work on trained and untrained people alike.
Sorting tactics by delivery channel shows how the pretext shifts from inbox to phone to physical space, and generative AI raises the credibility of each.
Effective defense layers reconnaissance limits, delivery filtering, phishing-resistant authentication, verification procedures, and rehearsed response so no single human decision carries the whole risk.
What Is a Social Engineering Framework?
A social engineering framework is a structured model of the steps an attacker takes to manipulate a person into granting access or sharing information. The manipulation may also cause a person to move money. The framework shows how those steps map to activity visible in the environment.
Social Engineering as Human Manipulation
Social engineering is the practice of deceiving a person so they reveal sensitive information or grant unauthorized access. The deception may also induce the person to commit fraud on the attacker's behalf. Attackers favor it because it skips the work of finding and exploiting software vulnerabilities: a manipulated employee resets a password or approves a wire, and the network opens. Phishing is one example, and social engineering also happens over the phone, by text, through a fake video call, and at a physical door.
Security knowledge alone does not reliably prevent these attacks because they apply cognitive as well as informational pressure. The National Institute of Standards and Technology's (NIST) Phish Scale rates phishing difficulty partly on how closely the message matches the target's job responsibilities, business practices, and expectations. Emails that align closely with those expectations and contain few visible cues are the hardest to detect. A finance clerk who processes vendor invoices all day reads a convincing fake with the same fast, intuitive processing.
Frameworks as Maps of Attacker Behavior and MITRE ATT&CK
A framework turns that manipulation into a map with named phases, so defenders can map each control to a phase. Kevin Mitnick describes an attack cycle in The Art of Deception. Mouton and colleagues expanded that model in 2014 into the six-phase Social Engineering Attack Framework (SEAF). Their model added attack formulation and preparation as distinct phases and replaced the final stage with a debrief.
MITRE ATT&CK approaches the same behavior from the network side. In its Enterprise matrix, social engineering shows up under several tactics at once. Reconnaissance includes phishing for information, while initial access includes phishing techniques. Multi-factor authentication request generation appears under credential access. ATT&CK also lists mitigations against phishing, including sender authentication and attachment and site restrictions. It lists user training as well.
The two views answer different defensive questions. The lifecycle model explains the attacker's progression and human interaction, while the network model organizes activity that monitoring and security controls can observe. Together, they connect a believable request to technical events such as phishing delivery or a password reset. A burst of authentication prompts is another event they connect to the request.
How Does the Social Engineering Framework Work?
The six SEAF phases run attack formulation, information gathering, preparation, relationship development, relationship exploitation, and debrief, and each one gives a defender something specific to watch for. Scattered Spider's help-desk impersonation campaigns illustrate all six
Attack Formulation and Information Gathering Define the Target
Attack formulation is the attacker deciding what they want and from whom. For Scattered Spider, the Cybersecurity and Infrastructure Security Agency (CISA) issued a CISA advisory that describes the goal as account takeover in single sign-on (SSO) environments followed by data theft for extortion, with a target set of organizations and their IT help desks.
Information gathering is where the attack first touches the organization. The advisory describes these attempts as "enriched by access to personal information derived from social media, open-source information, commercial intelligence tools, and database leaks." The Federal Bureau of Investigation's (FBI) July 2025 advisory update adds a detail defenders can act on: the actors first learn what steps help desks require for password resets, then call again for reset details on a chosen employee. A help desk that logs low-stakes questions about procedure or organizational structure can review them together as reconnaissance.
Preparation and Relationship Development Build the Pretext
Preparation converts raw intelligence into a pretext, the fabricated scenario that makes the request seem legitimate. The attacker assembles the employee's personal details, learns the wording the help desk expects, and spoofs a caller ID or registers a look-alike domain. This phase is invisible to the victim, so structural controls matter most: a help desk that will not disclose its verification steps, and a smaller public footprint.
Relationship development is the first contact: Scattered Spider actors pose as company IT or help-desk staff when calling employees, or as employees when calling the help desk. Authority comes from the IT role, while liking comes from fluent internal jargon and accurate personal details. A small request, such as confirming a username, creates commitment and makes the larger request feel like a continuation. Warning signs include a caller who knows a great deal yet cannot complete one verification step or asks to skip procedure "just this once." A caller who allows no time for a callback is another warning sign.
A required callback or independent identity check interrupts the interaction before trust becomes authorization. It also gives staff time to compare the story with directory information, ticket history, and established procedure.
Relationship Exploitation and Debriefing Complete the Attack
During exploitation, the advisory states that the actors use social engineering to convince IT helpdesk personnel to reset passwords and multi-factor authentication (MFA) tokens, and then take over those accounts in the SSO environment. The same group also uses push bombing. The attacker floods the real user with MFA prompts until one gets approved.
During debrief, the attacker steers the target back to a calm state and covers tracks so the interaction ends before the target begins to question what happened. Technical telemetry may then provide the only remaining signal. It may show a new MFA device enrolled minutes after a help-desk ticket or a login from an unfamiliar location. It may also show a password reset for a user who never called. Phishing-resistant MFA helps close the phishing, push-bombing, and subscriber identity module (SIM)-swap paths used in these attacks.
Because exploitation combines a human request with immediate technical activity, the sequence often provides the strongest signal. Connecting help-desk records with authentication telemetry helps responders revoke sessions and remove unauthorized MFA devices before the attacker gains further access.
Social Engineering Tactics by Delivery Channel
Delivery channels have different media and technical footprints, but they rely on the same psychological levers.
Email Attacks: Phishing, Spear Phishing, Whaling, and Business Email Compromise (BEC)
Three levels of targeting stretch across a single scale, from broad to narrow:
Phishing: A broad send of authentic-looking but bogus emails that request information or steer recipients to a fake site.
Spear Phishing: Narrows the audience and adds context about the victim, so the message reads like something the target was already expecting.
Whaling: Narrows further to senior leaders, usually to trigger fraudulent payments.
BEC differs from the other three because the attacker often controls a legitimate mailbox, either through earlier phishing or through vendor impersonation. A Justice Department case described attackers who registered companies under a real supplier's name and sent forged invoices, contracts, and corporate stamps to redirect payments that were already due.
Generative AI changes the economics of the targeted end of this spectrum. In a Harvard study presented at the International Conference on Machine Learning (ICML) 2025, fully automated AI-written spear phishing emails drew a 54% click-through rate. That rate matched human experts and far exceeded the 12% rate of generic control emails. The models also produced target profiles from public data. This allowed information gathering and preparation to run at scale without a human researcher.
Voice and Text Attacks: Vishing, Smishing, and AI Impersonation
Vishing moves the pretext to the phone, where Voice-over-Internet Protocol services make caller ID trivial to spoof. Vishing also differs in tempo: the attacker adapts in real time to hesitation. Attackers frequently pair vishing with MFA prompts. They talk the victim through approving a login the attacker just triggered. Smishing uses Short Message Service (SMS), where a link can open a browser, draft an email, or dial a number with one tap.
Voice cloning and deepfake video raise the credibility ceiling on both channels. The National Security Agency (NSA), FBI, and CISA warn in a joint advisory that synthetic media can "impersonate leaders and financial officers" and that the underlying algorithms sit in open repositories. The advisory adds that free, widely available tools now make convincing fakes "essentially plug-and-play," producible with "limited or no technical expertise."
A familiar voice, face, or phone number can no longer provide sufficient proof of identity. Verification should move outside the channel carrying the request, such as through a callback to a directory number or an established internal process, especially for password resets, payment changes, or authentication approvals.
Relationship, Physical, Web, and Authentication Attacks
Several tactics work outside email and phone, each keyed to a different lever:
Pretexting: The fabricated scenario itself, which runs on any channel — a caller posing as a vendor who needs a full name and title "for verification" is pretexting.
Quid Pro Quo: Offers a service in exchange for credentials and runs on reciprocity.
Honey Trap: Builds a personal connection online to extract information over time and relies on liking.
Baiting: An attacker leaves infected removable media for someone to plug in.
Tailgating: An attacker follows an employee through an access-controlled door.
Watering-Hole Attacks: Infect websites a target group already visits, so the group's routine visits deliver victims to the attacker.
Push Bombing: The attacker holds a stolen password and repeats login attempts so the real user receives prompt after prompt. A CISA advisory on Iranian actors describes the technique as "bombarding users with mobile phone push notifications until the user either approves the request by accident or stops the notifications." The lever here is distraction plus fatigue.
Each tactic depends on making an unsafe action appear reasonable or easy. Physical access controls, web filtering, phishing-resistant authentication, and verification procedures address different channels without requiring employees to memorize every tactic.
Effective Defenses Mapped to the Social Engineering Framework
Defenses that hold up attach to a specific lifecycle phase, and the strongest make the attacker's ask impossible to fulfill even when the person believes it.
Reconnaissance and Delivery Controls Reduce Attack Opportunities
Reconnaissance controls shrink what an attacker can learn. Limiting public information that attackers can connect to employee email addresses, keeping help-desk verification procedures out of scripts callers can extract, and treating procedural inquiries as loggable events all raise the cost of information gathering.
Delivery controls target the preparation and first-contact phases:
Email Authentication: Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are components of email authentication. Domain-based Message Authentication, Reporting, and Conformance (DMARC) with a reject policy helps receiving mail systems identify and reject messages that claim to come from your domain but fail authentication; CISA's phishing guidance treats a reject policy as the default to aim for.
Web Filtering: Blocks known malicious sites and command-and-control infrastructure so a click on a phishing link goes nowhere.
Warning Banners and Spam Filtering: Add context such as banners, spam filtering, and in-email phishing warnings when delivery controls cannot make a final determination.
Together, these controls shrink the volume of pretexts that ever reach an employee, which means fewer moments where a convincing request depends on human judgment alone. The fewer messages that land in the inbox, the more attention staff can give to the ones that do.
Verification, Authentication, and Human Controls Interrupt Exploitation
Exploitation-phase controls decide whether a convinced person can actually do harm. The most consequential is phishing-resistant MFA. NIST's July 2025 revision of its digital identity guidelines requires authenticators at the highest assurance level to hold a non-exportable private key and provide phishing resistance, which in practice means Fast Identity Online (FIDO) and Web Authentication (WebAuthn). Public key infrastructure (PKI)-based methods also meet these requirements. Hosted mail and SSO systems are practical starting points because they usually support these methods already, while number matching blunts fatigue attacks where push-based MFA has to remain for now.
Verification procedures handle payment changes and MFA resets. They also govern new-device enrollments. A callback to a directory number and a second approver for changes to banking details break the pretext without requiring anyone to detect it.
Training still matters, but the evidence argues for changing its shape. A 2025 Institute of Electrical and Electronics Engineers (IEEE) study of hospital employees found no significant relationship between recent awareness training and phishing failure, and embedded training moved click rates only marginally. Role-based training focuses on the specific requests that finance personnel and security personnel receive. It also addresses requests sent to senior leadership. Pairing it with a one-click reporting path and a no-blame response turns employees into sensors: a pretext one person reports is a pretext the whole organization can block.
Incident Response Controls Contain and Recover From Compromise
Response controls cover the debrief phase and everything after it, when the attacker believes they have won.
Out-of-Band Verification: Responders confirm the suspected incident with the affected employee and leadership by phone or in person, not through a possibly compromised mailbox.
Immediate Reporting: Staff report internally the moment something feels wrong and externally as obligations require. Covered critical infrastructure entities must report to CISA within 72 hours under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).
Containment: Responders reset affected credentials, revoke sessions and tokens, remove MFA devices enrolled during the incident window, and block the domains or numbers involved.
Financial Recovery Escalation: The organization contacts the sending bank immediately and files with the FBI's Internet Crime Complaint Center through the published BEC reporting path; its Recovery Asset Team works with financial institutions to freeze funds, and the odds fall as hours pass.
Recovery and Lessons Learned: Staff restore access through verified channels, then map the incident back onto the six phases.
The sequence keeps responders from relying on a compromised channel, limits further access, and improves the chance of financial recovery. Mapping the event afterward shows where an additional interruption point could have changed the outcome.
Building Resilience at Every Phase
Viewed as a lifecycle, social engineering stops looking like an endless variety of scams and starts looking like one process with six chances to interrupt it. A useful evaluation considers which phase a defense disrupts and what happens to the attack if that control fails.
Frequently Asked Questions
What Are the Phases of the Social Engineering Framework?
Mitnick's attack cycle and SEAF describe social engineering as a multi-stage process that includes preparation or information gathering, rapport-building or engagement, exploitation or execution, and disengagement or escape. The planning stages leave the fewest traces; the contact stages are where a person can still interrupt the attack.
How Does Social Engineering Differ From Phishing?
Phishing is the deceptive-message channel within social engineering. The wider discipline also covers phone calls, texts, in-person approaches, and prompt-flooding attacks that involve no message at all.
Can Awareness Training Alone Prevent Social Engineering Attacks?
Generic, once-a-year training leaves some convincing requests uncovered and some mistakes unavoidable. Training works best when tailored to specific roles and paired with controls that hold even after someone is deceived: authentication that users cannot hand over, and mandatory callbacks for financial changes.