Social Engineering: An Unknown Concept

The Human Factor in Cybersecurity: Why Awareness is Key

When we hear the term cybersecurity, we often think of device and network protection: antivirus, firewalls, data encryption. The human factor is frequently forgotten or relegated to the background, despite studies showing that more than 90% of security incidents involve people in some way.

While organizations are increasingly aware of this, incidents continue to occur daily. Most are caused by employees without malicious intent, with social engineering attacks playing a major role.

Social engineering: an underestimated threat

Social engineering manipulates people into performing actions that benefit the attacker — such as clicking a link, downloading a file, providing credentials, or making transfers.
Phishing is the most well-known example, but vishing (voice calls), smishing (SMS messages), and even face-to-face interactions are also common.

Anyone can be a victim — not just those working with sensitive data. An employee may receive a malicious USB stick, a fraudulent phone call, or a convincing fake email.

Real-world examples

• Mapfre (2020) – A phishing email compromised an employee’s credentials, granting attackers access to systems. The breach escalated into a ransomware attack.
• Zendal (2020) – Using CEO fraud, attackers impersonated executives and auditors via email, leading to transfers worth €9 million before detection.
• State Public Employment Service of Spain (2021) – Ryuk ransomware spread across employee devices, encrypting critical information. Negligence, such as executing malicious files, played a role.
• Infected USB scams – US companies received USB drives disguised as gifts from Amazon or government agencies. Once connected, they installed ransomware.
• WeTransfer impersonation – Emails claimed to include a court summons, directing victims to a fake WeTransfer site to steal credentials.
• Microsoft support scam – Through vishing, attackers posed as Microsoft technicians, convincing victims to install remote-control software, granting them full access to sensitive data.

Building human firewalls

Just as we install technological defenses, people must also become a line of defense. This requires comprehensive awareness — knowing not just how to manage passwords or maintain a secure workplace, but also how to detect and respond to diverse attack vectors.

Phishing may be the most common, but threats like baiting (infected USB drives) and vishing are equally dangerous. Cybercriminals exploit human vulnerabilities just as they exploit software flaws.

Understanding these weaknesses — and recognizing them in ourselves — is essential for staying alert and preventing attacks with potentially serious consequences.