SERisk domain
Social engineering
Social engineering covers every way a person is reached and deceived: email, SMS, voice, QR codes, deepfake media, help-desk pretexting and payment-fraud requests. The domain measures who attackers target, who is worth targeting and who takes the bait or reports it. It spans simulated lures and real attacks, and it treats a report as the vigilant twin of a click. It opens four of the eleven sequences in this model.
Classification
- Dimensions Every signal answers one of 3 questions.
- Evidence levels
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AT-01
- DE.CM-01
- DE.AE-06
- ID.RA-03
- MITRE ATT&CK
-
- TA0001 Initial Access · T1566 Phishing, T1684 Impersonation, T1204 User Execution
Social engineering is the human entry point that the Verizon DBIR tracks as its own breach pattern and VERIS records as the Social action. Every other domain is easier to defend when fewer people take the bait and more people report it.
Three dimensions in social engineering.
- Threat6 signals
- Threat is who is targeted by real lures and through which channel: phishing delivered, impersonation attempts, callback and voice phishing, SMS lures, and a mailbox that has started sending malicious mail.
- Access3 signals
- Access is who an attacker would most want to reach: people in publicly visible roles, payment approvers and help-desk staff who can reset passwords or MFA for others.
- Behavior18 signals
- Behavior is what a person does with a lure: clicking, submitting credentials, opening attachments, replying or granting remote access on the risky side; reporting, verifying out of band and deleting without engaging on the vigilant side.
Signals
27 signalsScroll sideways to see every column.
Headline metrics and grade bands
6 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-SE-1Real phishing click rate | % of delivered real phish clicked | ≤ 1 | ≤ 2 | ≤ 4 | ≤ 8 | Framework benchmark; DBIR 2026 human-element share |
| M-SE-2Simulation click rate | % of simulated lures clicked | ≤ 3 | ≤ 5 | ≤ 8 | ≤ 12 | Framework benchmark, 12-month programs |
| M-SE-3Report rate | % of simulations reported | ≥ 60 | ≥ 40 | ≥ 25 | ≥ 10 | Forrester HRM metrics; Framework benchmark |
| M-SE-4Repeat clickers | % of workforce with 3+ clicks in 180 days | ≤ 1 | ≤ 2 | ≤ 4 | ≤ 7 | Framework benchmark |
| M-SE-5Time to first report | median minutes from delivery to first report | ≤ 10 | ≤ 60 | ≤ 240 | ≤ 1440 | Framework benchmark |
| M-SE-6Susceptibility by lure trigger | % click rate on the most effective trigger (urgency, authority, reward, fear) | ≤ 4 | ≤ 8 | ≤ 12 | ≤ 18 | Forrester: emotional susceptibility by key triggers; Framework benchmark |
Indicator library
75 indicators- I.0001Opens real phishing emails
- I.0002Receives real phishing emails
- I.0003Receives real phishing emails with malware
- I.0004Target of real phishing emails
- I.0005Clicks links in real phishing emails
- I.0006Enables phishing reporter buttons
- I.0007Reports suspected phishing or other suspicious emails to security for analysis
- I.0008Reports suspected phishing emails that are tagged as suspicious
- I.0009Reports real phishing emails
- I.0010Reports real phishing emails resulting in quarantine
- I.0011Reports legitimate emails as phishing emails
- I.0012Reports suspicious SMS messages
- I.0013Replies to emails from unknown or spoofed senders
- I.0015Opens attachments from quarantined email messages
- I.0016Opens attachments from email messages with unknown senders
- I.0017Deletes phishing emails without opening
- I.0018Marks legitimate security alerts as junk messages
- I.0019Replies to flagged phishing emails after warning
- I.0020Downloads attachments from emails with mismatched display name and sender
- I.0021Configures a mailbox rule that bypasses security controls
- I.0026Accepts file transfers from unknown external contacts
- I.0028Attempts to bypass attachment blocking by renaming files
- I.0029Adds potentially risky domains to "safe senders" list
- I.0030Replies all with external recipients
- I.0031Deletes security banner before sending messages
- I.0037Interacts with calendar invites that may pose security risk
- I.0039Clicks links in SMS messages from unknown senders or as part of SMS phishing simulation
- I.0040Enables macros in untrusted documents
- I.0041Accesses shortened URLs from unknown sources
- I.0042Attempts to download content from email messages with blocked external images
- I.0043Accepts redirected links from unknown domains
- I.0044Accepts shared file invites from spoofed domains
- I.0045Clicks unsubscribe links in unsolicited newsletters
- I.0046Opens encrypted messages from unverified senders
- I.0050Disables or tampers with emails security controls
- I.0051Opens simulated phishing emails one or more times
- I.0052Clicks links in simulated phishing emails
- I.0053Enters credentials on websites linked from simulated phishing emails
- I.0054Opens file attachments to simulated phishing emails
- I.0055Fails to report simulated phishing emails after opening
- I.0056Deletes simulated phishing emails without reporting
- I.0057Responds to simulated phishing emails
- I.0058Reports simulated phishing emails
- I.0059Forwards simulated phishing emails to security team
- I.0060Provides helpful feedback on simulated phishing emails
- I.0061Opens simulated SMS phishing messages
- I.0062Responds to simulated SMS phishing messages
- I.0063Fails to report simulated SMS phishing messages
- I.0064Reports simulated SMS phishing messages
- I.0065Ignores or deletes simulated SMS phishing messages
- I.0066Does not respond to simulated fraudulent MFA prompts
- I.0067Marks simulated fraudulent MFA prompts as mistaken
- I.0068Denies simulated fraudulent MFA prompts and reports them
- I.0092Reports high confidence in phishing-related self assessments
- I.0093Reports low confidence in phishing-related self assessments
- I.0097Fails phishing simulations less frequently over time
- I.0099Fails security simulations less frequently over time
- I.0117Opens shortened URLs from unknown senders
- I.0130Reports phishing emails without clicking
- I.0136Hovers over links before clicking
- I.0243Demonstrates susceptibility to authority exploitation
- I.0244Demonstrates susceptibility to urgency and scarcity pressure
- I.0245Demonstrates susceptibility to fear and intimidation
- I.0246Demonstrates susceptibility to trust and familiarity abuse
- I.0247Demonstrates susceptibility to reciprocity and obligation
- I.0248Demonstrates susceptibility to curiosity and novelty triggers
- I.0249Demonstrates susceptibility to greed and reward motivation
- I.0250Demonstrates susceptibility to empathy and helpfulness
- I.0251Demonstrates susceptibility to commitment and consistency
- I.0252Demonstrates susceptibility to social proof and herd mentality
- I.0253Demonstrates susceptibility to overconfidence exploitation
- I.0254Demonstrates susceptibility to fatigue and cognitive overload
- I.0255Demonstrates susceptibility to fear of missing out (FOMO)
- I.0256Demonstrates susceptibility to sympathy manipulation
- I.0257Demonstrates susceptibility to pretexting deception
Cohorts in this domain
7- Clicks simulations while targeted by real phishing Targeted · SE-B-01 + SE-T-01
- Real-phish clicker with privileged access High-impact · SE-B-04 + IA-A-01
- Social engineering critical triad Critical · SE-B-01 + SE-T-01 + IA-A-01
- Silent repeat clicker Risky · SE-B-08 + not SE-B-10
- Help-desk staff deceived by voice simulations High-impact · SE-B-05 + SE-A-03
- Payment approver fooled by impersonation High-impact · SE-B-01 + SE-A-02
- Human sensor Vigilant · SE-T-01 + SE-B-12
Sequences that start here
4Cite this term
"Social engineering" (SE), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/social-engineering
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.