Social engineering in Red Teaming: How hackers target your workforce

Ask any security consultant how most serious breaches begin, and you’ll hear the same answer again and again: not with a zero-day exploit or a stolen encryption key, but with but by using social engineering — a phone call, an email, or a stranger at the front desk. It sounds almost disappointingly simple. There are no flashing red alarms, no lines of code scrolling across a dark screen, no Hollywood-style countdown timers. Just a person doing what they’ve always been encouraged to do; respond quickly, be helpful, trust their colleagues, and in that moment, handing an attacker the keys to the kingdom. 

In this blog we’re going to explore what social engineering in red teaming looks like and how you can take steps to ensure that building a good security culture is your best line of defense.

The hidden power of social engineering

The reality of social engineering isn’t a sideshow or a gimmick. It is often the most direct, most reliable, and quietest route into an organisation. And yet, it remains one of the most misunderstood aspects of cybersecurity. Not because it is technically complex, but because it targets something we rarely think of as a vulnerability: human nature. 

I’ve spent years working as a penetration tester, mostly focused on web applications, and I’ve always had more than a passing interest in red team engagements. I’m fortunate enough to work with some seriously talented operators here at Evalian.  

Why social engineering remains so effective

In nearly every engagement that we run, the breakthrough comes not from cracking a cypher or bypassing a firewall, but from convincing someone to do something they believed was normal, necessary, or even helpful.  

But you only need to listen to a few episodes of Darknet Diaries to hear the stories of red-teamers who’ve gained credentialed access after a single call to a helpdesk,  or compromised entire networks because someone plugged in a USB drive they found in the staff car park.  

None of these people were careless. None were naive. They were doing their jobs exactly as they’d been trained to do them. The problem was that the attackers had studied not just the technology, but the culture, the workflows, and the unspoken rules of the organisation. And that is what makes social engineering so effective, and so difficult to defend against. 

A real-world example: tailgating into an office

Let me tell you about a time this played out in real life. I was on a physical pen test engagement for a client. I arrived at their office during the busy morning rush, laptop in hand, pretending to be on the phone, talking about IT issues just outside the main entrance.  

I looked thoroughly bored, the best disguise there is in my opinion, and muttered my half of a made-up conversation into my phone. I waited until a group of employees came back from a coffee run and walked in together. I followed them in, still on the phone, blending right in. 

Each floor needed an access card to get into the main office sections, so I stayed in the stairwell, continuing my fake call. A few minutes later, someone exited an office and, seeing me lingering, held the door open with a polite nod.

Still on the phone, I walked in, made myself a cup of tea in the common area, because nothing says “I belong here” like making tea and then calmly found an empty desk. I sat down, opened my laptop, and plugged into the network.

From outside the building to inside and connected in about fifteen minutes. No one challenged me. As long as I looked bored and busy, I was just another face in the office… 

That’s the power of social engineering. It doesn’t require lock picks or hacking tools. It requires patience, observation, and an understanding of how people behave in shared spaces. And it works because, in most workplaces, being helpful and unobtrusive is rewarded, not questioned. 

Red Teaming is not just about computers

To understand why social engineering features so heavily in red teaming, it helps to understand what red teaming actually is and how its different from our beloved penetration testing.

Take a deeper dive by reading our article: The difference between pen testing and red teaming. 

A penetration test is, at its core, a technical audit. You give a tester a specific scope, say, your external web servers or an internal application, and ask them to find as many vulnerabilities as possible within that well-defined boundary.

The focus is on systems, code, and configurations. Social engineering might be included, but it’s often optional and limited in scope. The pen tester asks “What can I break, and how can I use it to do bad things?” 

Our Red Team podcast episode highlights the differences between standard red teaming and penetration testing, as well as taking a look at why Evalian’s Red Team Essentials service is perfectly placed for organisations who do not have the budget to carry out full red teaming assessments that involve the physical side of it.

How attackers use social engineering

Red teaming is different. It starts with a goal, not a scope. The client says, “Can you get access to our customer database?” or “Can you steal the prototype designs from the R&D lab?”. In some cases, they’ll simply say “Do your worst” and let you go at it.  

The red team then figures out how a real attacker would achieve that objective, using any realistic method available. That might include traditional computer hacking, but it will almost certainly include deception, impersonation, and psychological manipulation. 

Think of it like this. If a penetration tester is like a locksmith hired to check every lock on your building, a red teamer is like a professional thief hired to steal something specific from inside. The locksmith will test deadbolts, window latches, alarm sensors.  

The thief, however, might strike up a conversation with the night cleaner, pose as a delivery driver, or leave a USB drive labelled “Q3 Layoffs – CONFIDENTIAL” in the lobby. The thief isn’t interested in every lock. They’re interested in the path of least resistance, and that path almost always leads through people. 

This isn’t speculation. Real-world attackers operate this way because it works. There are countless, high profile, successful cyber attacks over the years that show that the majority of breaches involve the human element. We’re talking phishing, pretexting, misuse of credentials, or simple error.  

Why spend weeks trying to exploit a rare software flaw when you can spend five minutes on LinkedIn, write a believable email from IT, and have an employee hand you their password? 

Red teaming mirrors this reality. It assumes that attackers will use every tool at their disposal, including human psychology, and tests whether your defences hold up under that kind of pressure. 

The three ways attackers trick people

In practice, social engineering in red teaming unfolds in three overlapping ways: through digital channels, over the phone, and in person. Each method exploits different instincts, but all rely on the same core principles: plausibility, urgency, authority, and trust. 

Digital deception (phishing and email attacks)

Digital social engineering is the most common, but it’s often misunderstood. It’s not about sending generic phishing emails with poor grammar and suspicious links.  

Real red teamers invest time in reconnaissance. They study your website, your press releases, your job postings, your public GitHub repositories. They look at your employees’ LinkedIn profiles to understand reporting lines, project names, and internal jargon. Then they craft messages that fit seamlessly into your daily workflow. 

For example, if your company is rolling out a new benefits portal, a red teamer might send an email titled “Action Required: Enrol in New Benefits by Friday” from an address like “benefits@yourcompany-portal.com.” The domain looks legitimate at a glance. The email uses the same tone and formatting as your HR team.  

The link leads to a perfect clone of your login page, hosted on a lookalike domain. When the user enters their credentials, they’re silently harvested and the user is redirected to the real site, none the wiser. 

But the real artistry comes in chaining these attacks. A red teamer might start by phishing a low-level employee in marketing, just to gain a foothold in the email system. Once inside that inbox, they monitor communications for a few days. They see an email thread about an upcoming board meeting. So they send the CFO a calendar invite from the compromised account: “Prep Materials for Board – Confidential.”  

The attached Word document contains a macro that, when enabled, connects back to the red team’s server. Because the email appears to come from an internal colleague, it bypasses spam filters… and the CFO opens it without hesitation. 

This kind of multi-stage attack is not hypothetical. It’s standard practice for both red teams and real-world adversaries. And it works because it mirrors how real work happens. No one expects an email from HR to be a threat. No one questions a calendar invite from a colleague. And that’s exactly what the attacker counts on. 

Vishing: exploiting trust over the phone

Verbal social engineering, or vishing, exploits our instinct to trust voices, especially when they sound confident and familiar. A red teamer might call your finance department pretending to be from your bank’s fraud team: “Hi, this is Sarah from [wherever your company banks]. We’ve flagged a suspicious transfer from your account—can you confirm the last four digits of your company card?” Or they’ll ring IT support as “the new hire in sales” whose laptop “won’t connect to Wi-Fi,” asking for a temporary password reset. 

The key is in the details. They’ll use real names they found online. They’ll mimic your company’s jargon: “Just pop it in the shared drive under Q3_Initiatives.” They’ll add urgency: “This needs to be sorted before the audit tomorrow.” And because most companies have no way to verify caller identity (and that its terrifyingly simple to spoof phone numbers), these calls often succeed on the first try. 

Physical intrusions: exploiting real-world access

Physical social engineering is the most tactile and often most effective form. This is where the red teamer steps out from behind the keyboard and into the real world. Dressed as a delivery driver, a fire inspector, or even a new intern, they rely on social norms to gain access, holding the door for someone carrying boxes. Not questioning someone who looks like they belong. These are not security failures; they’re human instincts. 

I remember another physical engagement where I’d been inside the office for hours. Using organisational information about the head of IT that I found on LinkedIn, I pretended to be there to fix Wi-Fi issues, because, well, there are always Wi-Fi issues.  

I set up a rogue access point and cloned the corporate Wi-Fi captive portal, but I edited it to look like a speed test page. After talking to a couple of employees and asking if they’d had connectivity problems, I successfully convinced them to connect to my network. One employee even entered their username and password when I asked them. 

Were I a real attacker, I could have sent those credentials to a remote server or left the office and logged back in using a hidden network tap device I’d plugged in earlier. Basic user credentials can often be used to elevate privileges in network environments, potentially leading to complete domain compromise. All it took was a plausible story, a friendly face, and the universal truth that everyone hates slow Wi-Fi. 

Why traditional awareness training falls short

Many organisations respond to the threat of social engineering with security awareness training. They show videos, send quizzes, put up posters that say “Think Before You Click!” And while well-intentioned, this approach often fails because it treats the problem as one of ignorance rather than psychology. 

The truth is, people aren’t falling for these attacks because they don’t know better. They’re falling for them because the attacks are designed to bypass rational thinking. They trigger emotional responses like urgency, fear of getting in trouble, the desire to help a colleague.

Telling someone “don’t click suspicious links” does nothing when the email looks identical to the ones they receive every day, references a real project, and arrives at 4:55 PM on a Friday when they’re trying to wrap up for the weekend. 

I know people who aced their security training fall for a phishing email because it came from what looked like their manager’s address and said something like, “Can you approve this invoice before I leave for holiday?” They weren’t being careless. They were being helpful, and that’s exactly what the attacker counted on. 

Traditional training also fails to simulate real-world pressure. In a quiz, you have time to think. In real life, you’re juggling ten tasks, your inbox is overflowing, and the email says “URGENT: ACTION REQUIRED.” Under those conditions, even the most security-conscious person might slip up. 

Building cyber defences that work with human nature

So what can you do? How do you protect an organisation when the attack surface includes the very qualities that make your team effective: responsiveness, collaboration, trust? 

The answer isn’t to create a culture of suspicion. That’s neither sustainable nor healthy. Instead, focus on designing systems that assume someone will make a mistake, and then make that mistake less catastrophic. 

Start by assuming the click will happen. Instead of relying solely on prevention, build detection and response capabilities that catch the fallout. Use email security tools that rewrite links so every click is monitored.

Deploy endpoint detection that flags unusual logins, like an HR user suddenly accessing R&D servers at 2 a.m. And enforce multi-factor authentication everywhere, especially phishing-resistant methods like physical security keys, which render stolen passwords useless. 

Next, add friction to high-risk actions. Require dual approval for financial transfers or sensitive data exports. Enforce the principle of least privilege so that even if an account is compromised, the attacker’s movement is limited.

Separate administrative tasks into accounts that are never used for day-to-day work, reducing the chance of credential theft. 

Creating a culture of resilience

But perhaps the most powerful defence is cultural. Run realistic, multi-stage simulations that mirror how real attackers operate, not just one-off phishing tests. Exercises that combine email, phone calls, and even physical visits. And when someone falls for a test, respond with empathy, not blame. Say, “You weren’t tricked, you were targeted. Here’s how we’ll protect you next time.”

Foster an environment where employees feel safe reporting suspicious activity, knowing they’ll be thanked, not scolded. 

When I deliver training on cybersecurity, the thing that I try to drive home is that cybercrime is a full-time, multi-billion-pound industry where teams of very smart people spend 40+ hours a week working on ways to steal your stuff. They’re well-resourced, well-financed, and determined. It’s for us in IT to make sure that individually and collectively, we’re giving ourselves the best chance of defending ourselves. 

But it’s not all bad news. I’ve seen real progress. On another physical engagement, I tried the same tailgating trick, walked in behind a group, and headed for the stairs. But this time, the client had learned from past tests. I was challenged at reception, then in the office several times.

My cover story was thin; I only had the names of a couple of contacts, and when I tried to slip away, I was politely but firmly pursued by both the receptionist and another member of staff. They cornered me, asked for identification, and when I couldn’t provide it, they escorted me off the premises. 

That moment was a win, not for me, but for them. It showed that awareness had turned into action. That employees felt empowered to question strangers. That security wasn’t just IT’s job; it was everyone’s. And that’s the kind of culture that stops real attackers in their tracks. 

Security is a shared responsibility

Social engineering in red teaming ultimately reveals a fundamental truth: cybersecurity is not just a technical challenge; it is a human one. It lives at the intersection of psychology, process, and technology. And while we cannot (and should not) expect perfection from our colleagues, we can build environments where their natural instincts are protected rather than punished. 

The goal isn’t to create a workplace where every email is viewed with paranoia and every stranger is treated as a threat. That’s neither practical nor conducive to a healthy culture. The goal is to create a culture of resilience. where security is seen as a shared responsibility, where mistakes are learning opportunities, and where people feel equipped, not exposed. 

At the end of the day, your people aren’t the problem; they’re your greatest defence. Treat them that way, and you’ll find that the same qualities attackers exploit, like helpfulness, curiosity, and teamwork, will become your most enduring strength. 

That’s the real prize here: not just stopping an attack, but building an organisation that’s ready for the next one. 

Get a fast red teaming services quote

 View our Red Team Testing service

Are you considering penetration testing for your organisation or red team testing? Read our comprehensive guide to penetration testing costs.

You can also download a free Guide to Pen Testing here.

Red Team Essentials is the perfect solution for organisations that don’t have the budget to justify a full red team test. If you would like to know more about Evalian’s Red Team Essentials Service or would like a quote, get in touch today.

​