Tactics of Deception: Protecting Trust and Purpose
Trained people, strong controls, still getting fooled? This session breaks down how modern social engineering exploits trust and urgency, and what actually works to stop it.
Social engineering attacks no longer rely on poorly written phishing emails or obvious scams. Today’s adversaries exploit trust, authority, and urgency, often using AI-driven voice cloning, deepfakes, and highly tailored impersonation, to manipulate well-trained professionals into making high-impact decisions in minutes.
In this session, Bishop Fox's Alethe Denis, Red Team Sr. Security Consultant and DEF CON Social Engineering Black Badge winner, examines how modern deception tactics are being used to target extended vendor ecosystems. Drawing on real-world incidents, from vishing attacks that bypass bank controls to deepfake-enabled executive impersonation, this talk explores why traditional security controls often fail when the human element is under pressure.
Session Summary
This workshop explores tactics of deception and the human attack surface, focusing on how attackers exploit trust, urgency, and psychological pressure rather than technical vulnerabilities. Through real-world examples, including near-loss financial scams and deepfake-enabled fraud, the session demonstrates how social engineering manipulates human behavior to bypass traditional security controls. It highlights why existing defenses often fail under pressure and emphasizes the need for process-driven safeguards, cultural awareness, and human-centered security design to reduce manipulation-driven risk.
Key Takeaways
- Humans are not the weakest link, they are targeted because of inherent trust and social behavior.
- Social engineering attacks rely on psychological principles like urgency, authority, and scarcity.
- Attackers create cognitive overload and isolation to bypass verification and force compliance.
- Traditional security controls often fail due to time pressure, familiarity bias, and process drift.
- Deepfakes and AI increase realism, but manipulation tactics remain fundamentally human-driven.
- Effective defense requires process controls (e.g., callbacks, dual approvals) and intentional friction.
- A strong security culture empowers people to pause, verify, and escalate without fear or friction.
