Episode highlights
Social engineering is one of the oldest threats, and while the medium may have changed to incorporate technology, the speed at which it has scaled is beyond expectation.
In this conversation, Crane Hassold, one of our principal security researchers, breaks down why nearly every cyberattack still starts with human manipulation, how AI is changing the surface but not the strategy, and why most defenses fail when they rely too heavily on user behavior.
- Social engineering sits at the root of nearly all cybercrime. The tactics haven’t changed in decades, or even centuries. What has changed is delivery. Email, SMS, and cloud apps have replaced face-to-face deception, but the underlying manipulation remains identical.
This is not a technology problem. It’s a human one.
Scroll to timestamp ~00:01:00 for more on this topic. - Threat actors exploit instinctive, fast decision-making. The goal is always the same: trigger a reaction before someone has time to think.
Slowing people down improves outcomes, but it doesn’t eliminate risk. There will never be a zero-failure rate. If your strategy assumes that, it’s already broken.
Scroll to timestamp ~00:02:00 for more on this topic. - AI improves the quality of phishing lures. Emails look more polished, more convincing, and more personalized. That increases click rates significantly.
But this is where most conversations go off track. Just because something is possible with AI doesn’t mean attackers will use it. Most are still optimizing for speed and profit, not sophistication.
Scroll to timestamp ~00:04:00 for more on this topic. - The majority of cybercrime still relies on simple, proven techniques. Business email influence / compromise and low-effort scams continue to generate billions because they work.
AI will be used where it improves return. Until then, the path of least resistance wins.
Scroll to timestamp ~00:07:00 for more on this topic. - Security awareness has over-indexed on fear. Suspicious activity alerts, compromised accounts, urgent warnings.
What’s working now is the opposite. Promotions, bonuses, and rewards. Messages that feel positive, not threatening, are increasingly effective because they bypass skepticism.
Scroll to timestamp ~00:10:00 for more on this topic. - Strong defenses don’t depend on perfect behavior. They assume compromise and reduce impact.
Controls like MFA and passwordless authentication stop most phishing attacks even when users engage. The goal isn’t prevention at the edge. It’s containment at the core.
Scroll to timestamp ~00:15:00 for more on this topic.
Follow Microsoft Security