How to Perform and Combat Social Engineering

### Executive Summary This article explains social engineering techniques commonly used in red-team assessments and by adversaries, illustrates a successful HR-impersonation scenario that enabled an MFA account takeover through collected PII, and provides practical defenses such as verifying sender identities, using known contact channels, inspecting email headers, and conducting regular social-engineering training and tests to reduce risk.