Which group is commonly targeted by social engineering?

Which group is commonly targeted by social engineering?

• A. Receptionists
• B. Users
• C. Security Engineers
• D. Vendors of Target Org

Answer: (D)

Social engineering thrives on exploiting trust and access pathways that real people provide. Vendors of the target organization often sit at a valuable intersection: they are legitimate partners with ongoing interactions, credentials, and access that the organization already considers trustworthy. An attacker can wire in through this channel by posing as a vendor, sending fake invoices or maintenance requests, or convincing someone to grant access or reveal credentials. Because these relationships are trusted, messages from vendors are more likely to be acted upon without raising suspicion, making them a particularly effective and common target for social engineering. While receptionists or regular users are also targets—phishing emails or calls can trick them into divulging information or bypassing controls—the vendor relationship creates an amplified opportunity: external partners who already have legitimate access can serve as a bridge into systems, networks, or facilities with reduced scrutiny. Security engineers, though important, are fewer in number and typically more security-aware, so they’re not as routinely targeted as the vendor channel.

Social engineering thrives on exploiting trust and access pathways that real people provide. Vendors of the target organization often sit at a valuable intersection: they are legitimate partners with ongoing interactions, credentials, and access that the organization already considers trustworthy. An attacker can wire in through this channel by posing as a vendor, sending fake invoices or maintenance requests, or convincing someone to grant access or reveal credentials. Because these relationships are trusted, messages from vendors are more likely to be acted upon without raising suspicion, making them a particularly effective and common target for social engineering.

While receptionists or regular users are also targets—phishing emails or calls can trick them into divulging information or bypassing controls—the vendor relationship creates an amplified opportunity: external partners who already have legitimate access can serve as a bridge into systems, networks, or facilities with reduced scrutiny. Security engineers, though important, are fewer in number and typically more security-aware, so they’re not as routinely targeted as the vendor channel.