SC300: Social Engineering Basics UPDATE

Agenda:

• Threat landscape 2026 - where do the threats come from, who is affected? Creation of an individual threat landscape
  
  

• Legal and ethical aspects in the use of social engineering – including NIS2, DORA, transparency obligations of the AI Act as well as the permissibility limits of phishing and vishing simulations
  
  

• The classic levers – fundamentals of deception and persuasion:

  • Robert Cialdini – principles of influence and their application in attack scenarios

  • Daniel Kahneman – System 1 / System 2 as an explanation of why fast decisions are vulnerable

  • Paul Ekman – micro and macro expressions, basics of non-verbal communication

  • Christopher Hadnagy – pretexting and the structured development of an attack conversation

  • Kevin Mitnick – the art of deception: why classic cases still work today
    
    

• Research: from OSINT to SocMInt and HumInt

  • OSINT basics: deep web search, tools, source criticism and verification

  • SocMInt – what individuals and organizations reveal on social networks, and how this information is consolidated into a target profile

  • HumInt and elicitation – obtaining information in a conversation without asking for it

  • Creating false identities and cover stories
    
    

• How AI has changed things

  • Automated target research: consolidating public digital footprints into profiles in minutes rather than days

  • Mass generation of spear-phishing and whaling attacks – personalized and at scale

  • Deepfakes (voice & face) including real-time manipulation in video calls – tools, detection methods and the limits of human detection

  • Current fraud and scam scenarios: CEO fraud, invoice and payment manipulation, investment and relationship fraud, fake applications

  • Manipulation of AI assistants and agents through hidden instructions in documents, emails and websites
    
    

• Attack vectors in practice

  • Vishing, smishing, call spoofing and role-playing exercises

  • Attacks on the service desk: identity verification over the phone, resetting of passwords and second factors, phone number hijacking

  • Bypassing multi-factor authentication using social engineering: intermediary login pages, session hijacking, MFA fatigue, fraudulently obtained application authorizations

  • Self-executed browser-based attacks: fake error messages and security prompts tricking users into executing commands themselves

  • Channel-switching campaigns: coordinated chains via email, chat, phone, SMS and messengers

  • Physical methods: bypassing access controls and barriers, hacker USB and LAN tools, WLAN attacks (compact demonstration)
    
    

• Visibility and deception – the own side

  • Analysis of the own digital footprint: person, role and organization from an attacker's perspective

  • Deception as a countermeasure: targeted obfuscation, decoys and canaries, controlled misinformation

  • Reducing personal risks: grooming, identity theft, extortion – identifying warning signs and adopting protective behaviors

  • Verification as a control point: callback via registered channels, four-eyes principle for payment and authorization changes,agreed-upon passwords, clear approval workflows
    
    

• Practical part: the game of deception and detection – participants deceive and are deceived, then analyze the techniques used and practice interview techniques to uncover the truth:: structured interviewing, plausibility-oriented follow-up questions, identifying inconsistencies
  
  

• Lessons learned – analysis of own vulnerability, prioritization of measures and quick wins, design of awareness and incident playbooks

Objectives:

• Understand the classic levers of deception and persuasion and recognize them in real conversation situations

• Understand how AI has changed social engineering—and what has remained the same

• Gain a comprehensive understanding of social engineering attack paths, from the initial research phase through to the resulting damage

• Classify research skills in practice: OSINT, with a focus on SocMInt and HumInt

• Classify current fraud and scam scenarios: CEO fraud, invoice and payment manipulation, investment and relationship fraud, fake applications

• Develop awareness for one's own visibility – personally and organizationally

• Learning about deception as a countermeasure: targeted obfuscation, decoys, and canaries to reduce risk

• Classify and reduce personal risks: grooming, identity theft, extortion

• Recognize lies and expose deceivers—using questioning techniques to uncover the truth and nonverbal indicators

• Design verification processes that remain effective even against technically perfect deception

• Develop awareness and incident playbooks, as well as a prioritized list of measures for your own organization

Target audience:

The course SC300 Social Engineering Basics is aimed at:

• IT security management and information security officers

• CISOs

• Pentesters

• Red and blue teamers

• Persons responsible for Service Desk and user support

• Persons responsible for awareness programs and security culture

Prerequisites:

For participation in the training SC300 Social Engineering Basics no specific prior knowledge is required.

It helps to have a basic understanding of your own approval processes – such as the question of how a password is reset or a payment is approved within your organization.

Description:

Social Engineering today follows the same psychological patterns as in the past, however AI makes attacks faster, more precise, and scalable. The course SC300 Social Engineering Basics combines both: the classic levers of deception and persuasion according to Cialdini, Kahneman, Ekman, Hadnagy and Mitnick on the one side – and on the other the attacks that have only become possible through the current use of AI: automated target research, tailored spear-phishing and serial whaling, and real-time voice and facial mimicry. Research is not limited to OSINT tools. The focus is on SocMInt and HumInt – what people reveal about themselves and how one elicits it from them in conversation. Participants practice the interplay of deception and detection. They experience both sides: what it feels like to deceive—and the methods used to expose a deceiver.

Technical terms will be introduced in German; all participants will receive a glossary of terms and abbreviations as a handout.

Expand your knowledge with practical, expert-level skills in the advanced course SC305 Social Engineering Practitioner.