What is phishing and social engineering, and how do you defend against them?

Social engineering manipulates people rather than technology. It is the most successful attack category because it bypasses technical controls entirely — no exploit is needed if someone hands over their password.

The variants:

• Phishing — mass fraudulent emails.
• Spear phishing — targeted at a specific person using researched detail. Far more effective.
• Whaling — targeting executives.
• Business Email Compromise — impersonating an executive or supplier to redirect a payment. Financially the most damaging category by a wide margin, and it often involves no malware at all.
• Vishing and smishing — by phone and SMS.
• Pretexting, baiting, and tailgating — a fabricated scenario, a lure such as a dropped USB drive, or simply following someone through a secure door.

Defence in layers:

• Technical — email authentication with SPF, DKIM, and DMARC; attachment and link filtering; external sender banners; and above all phishing-resistant MFA such as FIDO2 security keys, which defeats credential theft even when the user is fooled.
• Process — out-of-band verification for payment changes. A callback to a known number defeats BEC almost entirely.
• People — regular simulations with training, measured by click and report rates.

Note: Say that the goal of awareness training is a reporting culture, not a zero click rate. Punishing people who click means the next victim stays silent, which is far worse.