Social engineering
Social engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust. Cyber Essentials has no social engineering control or question. The Danzell question set describes phishing as 'obtaining information by confidence trickery', and the technical controls limit the damage a tricked user can do.
- Term
- Social engineering
- Also known as
- Pretexting, Confidence trickery
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term social engineering mean in Cyber Essentials?
Social engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
How does social engineering apply to Cyber Essentials?
In plain terms
It is the con artist's craft applied to business: a caller claiming to be from your bank, an email that seems to come from your managing director asking for an urgent transfer, a new supplier asking to update their bank details. None of it needs technical skill. It works because people are helpful, busy and trusting.
What Cyber Essentials asks
The requirements do not mention it. The Danzell question set comes closest in the introduction to its malware section: "Malware is often used in conjunction with other kinds of attack such as ‘phishing’ (obtaining information by confidence trickery) and social network sites (which can be mined for information useful to a hacker) to provide a focussed attack on an organisation."
There is no general awareness training requirement. The nearest is supporting people to choose strong, unique passwords (A7.12). What the scheme does is limit the damage when someone is fooled:
- MFA on cloud services means a password handed over on a fake page is not enough on its own (A7.16, A7.17).
- Separate admin accounts mean malware launched by a tricked user runs with standard rights, not admin rights (A7.6, A7.7).
- Malware protection stops the attachment or blocks the malicious site (A8.1 to A8.3).
Worth knowing
Payment fraud, such as a changed bank detail on an invoice, is outside what Cyber Essentials checks. A simple rule, such as confirming any change of bank details by phone on a number you already hold, covers that gap.
See the user access control requirements. Related: phishing, multi-factor authentication.
Related terms
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Supply chain securitySupply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
Frequently asked questions
Social engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.