I used to think of social engineering as the less interesting part of offensive security.
Not useless. Just less interesting. The technical attack chains felt more rigorous — more like a discipline. Finding an unpatched service, chaining exploits, escalating privileges. Social engineering felt adjacent to that. A shortcut for when the technical path was blocked.
I was wrong about this, and understanding why I was wrong changed how I think about the whole field.
The Baseline Attack
Classic vishing goes like this. An attacker calls an employee, claims to be from IT or from a vendor, invokes some urgency — your account has been flagged, there’s a system that needs to be updated today, your VPN credentials need to be reset. The target provides credentials, clicks a link, installs something.
The defense is awareness training. Here’s what these calls look like. Here are the red flags. If someone asks for your password over the phone, that’s an attack.
This training works against the baseline attack. It doesn’t work against what’s happening now.
What Changed
Two things happened that shifted the economics of vishing.
First, voice cloning became cheap. Not just technically accessible — commercially available, consumer-grade, thirty seconds of audio to train a convincing clone. There are legitimate services for this. There are obviously less legitimate uses of the same technology.
Second, real-time audio synthesis became fast enough to be practical. You don’t need to pre-record a fake voice message. You can synthesize audio in real-time during a live call, with a few seconds of latency that’s becoming imperceptible. An attacker can speak in any voice while conducting the conversation themselves.
The combination of these two things breaks awareness training fundamentally. “Does the caller sound like someone you know?” is no longer a reliable question to ask. It might sound exactly like your manager. It might sound like the CEO. You might have heard their voice on a public podcast or a company all-hands recording, which is now training data.
A Specific Scenario
In 2024, a financial institution in Hong Kong lost 200 million HKD to a scam that used deepfake video of company executives in a Zoom call. Multiple employees participated in the call. None of them realized they weren’t talking to real people.
I keep returning to that number. Not because the amount is unusual in the context of financial crime — it isn’t — but because of what it represents technically. The attack didn’t require a single software vulnerability. No CVE. No patch. No exposed service. The attack surface was human perception and the reasonable assumption that video of a known face, in a plausible context, is authentic.
That assumption is no longer safe.
Testing This
I’ve been running controlled experiments. Nothing production — synthetic scenarios in isolated environments, testing how different types of generated audio perform against different listeners.
The results are uncomfortable. Unfamiliar voices are easier to evaluate critically. A caller claiming to be from IT, using a generic professional voice — people apply skepticism. When the voice is familiar — when it sounds like someone the target has heard before — the skepticism drops. The brain pattern-matches faster than it reasons.
This isn’t a weakness specific to particular people. It’s how auditory recognition works. We evolved to treat familiar voices as trusted signals. That heuristic worked fine when voice could only come from the person in front of you.
The Harder Problem
The technical countermeasures are real but limited. Real-time audio analysis for synthetic voice detection. Call verification protocols. Out-of-band confirmation for sensitive actions.
All of these can work. Most organizations don’t have them. And even the ones that do face an adversary that can iterate faster than defenses.
The more I think about this, the more I think the useful frame is not “how do we detect synthetic voices” but “what decisions should never hinge on voice confirmation alone.” Not because detection is impossible, but because you’re playing an arms race where the offense is currently winning.
Process matters more than detection. A policy that says wire transfers over a certain amount require a verification code sent through a separate channel — something the caller cannot know — doesn’t care whether the voice was authentic. It short-circuits the whole attack.
Why I Changed My Mind
I changed my mind about social engineering because I realized I was judging the attack vector by the sophistication of the specific attack, not the sophistication of what that attack vector could enable.
A phishing email that says “click here or your account will be suspended” is not sophisticated. That doesn’t mean email isn’t a powerful attack vector. It means that particular attack was unsophisticated.
Vishing someone into handing over credentials using a script they recognize as a scam isn’t sophisticated. Impersonating their CFO’s voice in real-time during a call that appears to come from the right number and matches a calendar invite isn’t.
The attack vector is the same. The sophistication is not.
Most of the machines I’ve compromised on HTB and in labs involved a combination of technical and human elements. The more I practice both, the more I understand why the best attackers don’t pick one. They don’t need to. The phone call that gets them a set of credentials is faster than a week of enumeration, and the technical path that follows is exactly what they would have taken anyway.