Social Engineering: The Analog Threat to Digital Defenses

U.S. businesses have never been more alert to cyber risk. Firewalls, endpoint protection, and multifactor authentication are embedded across corporate America. Every time digital threats escalate, businesses respond with new digital innovations.

Despite this arms race, one of the most effective ways into a business’s systems remains via social engineering. This is where a convincing email, telephone call, or video meeting is used to recruit an unwitting employee into a hacking attempt.

Social engineering is nothing new, but the way it is being executed has changed significantly in recent years. Rather than probing for weaknesses in a company’s digital defenses, criminals are exploiting how people work and the trust they have in a senior executive or regular supplier. Such is the sophistication of these attempts that employees are often authorizing fraudulent transactions because everything about the request appears credible.

The FBI received 24,768 complaints in 2025 relating to business email compromise, in which criminals pose as executives or suppliers to trick employees into sending money or sensitive information to unintended recipients. Reported losses exceeded $3 billion. Verizon, meanwhile, found some form of human involvement was present in 62% of the breaches examined for its latest Data Breach Investigations Report.

The techniques involved include:

• Business email compromise
• CEO fraud and executive impersonation
• Fake supplier payment requests
• Invoice manipulation
• Payroll diversion fraud
• Phishing and spear-phishing campaigns
• Deepfake voice and video scams

The criminal’s task is made easier by the fact that much of the information needed to make an attempt convincing is often freely available on corporate websites and professional social networks. This can include organizational structures, key personnel, supplier relationships, and so on.

Modern hybrid working practices compound the problem. Informal conversations that might once have happened face-to-face are now frequently conducted through email, messaging applications, and video calls. This has the unintended effect of opening new doors to criminal exploitation as it’s more likely that sensitive requests or dialogues might be made on a digital platform rather than in person.

AI is also heightening the threat. While businesses are adopting AI to track patterns and identify threats, criminals are using the same tools to add another layer of credibility to their attacks. A finance employee asked to make an urgent transfer by the chief executive may hear what appears to be the executive’s voice, or see them issue the instruction on a video call, when it is in fact a sophisticated AI-facilitated phishing attempt.

What makes social engineering so difficult to manage is that businesses must protect themselves against communications designed to resemble ordinary business activity. Relying on digital tools alone is highly likely to leave gaps in their defenses.

Many businesses have turned to cyber insurance as a financial backstop when their controls fail. But the presence of a cyber policy does not automatically mean the business is fully covered for the range of attacks it will face. Many cyber policies exclude social-engineering losses altogether, and even where cover is included, it is frequently restricted by a sublimit.

Relying on limits can leave a considerable coverage gap. NetDiligence’s 2025 Cyber Claims Study found that business email compromise cost large companies an average of $334,000, while the average loss from wire-transfer fraud reached $644,000.

While insurance can absorb the financial consequences of an attack, it cannot prevent the payment from being made or remove the disruption and distress it causes. Even with airtight cover, businesses still need to invest in preventative measures, such as:

• Multifactor authentication
• Segregation of payment approval duties
• Call-back verification procedures
• Supplier account change-verification protocols
• Regular phishing simulations
• Employee awareness training
• Executive-specific fraud prevention processes
• Incident response planning

As criminals continue to refine their techniques, businesses are responding with technology, strong procedures, well-trained employees, and tailored insurance to provide financial protection when their defenses fail.

But none of these measures are enough on their own. Businesses have the best chance of protecting themselves against social engineering–and recovering when it succeeds–by bringing their digital defenses, risk management, and insurance together as a single response to a threat that is growing by the day.