Social engineering
A manipulation technique that exploits human psychology rather than technical vulnerabilities to gain access to systems, data, or physical locations. Phishing is the most common form. AI has made social engineering attacks more sophisticated, personalized, and difficult to detect.
Defined in 2 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in Certified AI Practitioner: Workplace Foundations.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A manipulation technique that exploits human psychology rather than technical vulnerabilities to gain access to systems, data, or physical locations. Phishing is the most common form. AI has made social engineering attacks more sophisticated, personalized, and difficult to detect.
The practice of manipulating a person, such as a carrier's customer service representative, into taking an action (like approving a SIM change) through deception, impersonation, or false urgency, rather than through any technical hacking of a computer system.
Manipulating human psychology (trust, urgency, authority, fear) to bypass security controls. Phishing, vishing (voice phishing), pretexting, and baiting are all forms of social engineering. AI has made social engineering attacks more personalized and harder to detect.
The manipulation of a person into breaking security or handing over value by exploiting trust, authority, fear, urgency, or helpfulness, rather than exploiting a technical vulnerability. AI scales and personalizes it.
The general term for manipulating a person, rather than a computer system, into taking an action that compromises security, such as revealing information or granting access.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Digital Readiness Self-Audit · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- Online Safety, Privacy, and Data Basics · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- AI-Specific Threat Detection · AI Security Fundamentals, Certified AI Practitioner: Workplace Foundations
- Locking your phone number: port out protection and a SIM PIN · The Hardening Lab, Senior AI Scam Defense
- Account Takeover Starts With a Help Desk, Not a Hacker · Account and Asset Theft, Senior AI Scam Defense
Where it shows up at work
A definition is where Social engineering starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Recognizes AI-enabled fraud, from cloned voices and synthetic video to romance and investment scams, and knows the one move that breaks the script.
One lesson on this page teach it as a primary outcome.
Understands prompt injection, data poisoning, model theft, insecure integrations and excessive agent privileges, and the controls that reduce each.
One lesson on this page teach it as a primary outcome.
Builds minimization, purpose limitation, de-identification, consent and retention into an AI system before launch, with tests that prove it.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Chief Information Security Officer, AI security focusneeds it at depth
- Chief Technology Officer, AI engineering editionneeds it at depth
- AI Incident Response Leadneeds it at depth · 1 open posting this week
- AI Security Architectneeds it at depth · 8 open postings this week
- AI Governance Engineerneeds it at depth · 7 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: FTC guidance; FinCEN elder financial exploitation advisory; OWASP Top 10 for LLM Applications; Google SAIF.
One interview question about it
A caller sounds exactly like a colleague and asks for a transfer. How do you tell a voice clone from a person, and what is the rule?
Asked of candidates for deepfake, voice-clone and scam recognition. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Elder services, social work, banking front line and fraud teams carries it as a claim to back up: Fraud patterns are familiar; the synthetic versions are new.
- Cybersecurity and IT carries it as a claim to back up: Threat modeling and control design transfer; the AI-specific threats are new.
- A computer science or software engineering degree carries it as a claim to back up: Security fundamentals are a course you took, not yet a control you ran.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.