By the time a phishing email lands in your CFO’s inbox, the attacker has usually already done their homework. They know who your CFO reports to, which vendor just closed a contract with you, and possibly even the tone your internal emails use. That email is not the attack. It is the final step of one.
For CISOs and security leaders, this changes the question worth asking. It is not just “how do we stop phishing emails” but “how much of our organisation’s attack surface is already public, and do we know it?”
This guide breaks down how attackers actually gather intelligence on a target before launching a social engineering attack, the five sources they rely on, and what security teams can do to close that exposure before it becomes an incident.
Key Takeaways
- The human element is a factor in roughly 60% of all confirmed data breaches, according to the Verizon 2025 Data Breach Investigations Report.
- Social engineering attacks are executed in four stages: information collection, trust building, manipulation, and utilization. The first stage determines how convincing the rest of the attack will be.
- Attackers draw on five distinct intelligence sources: OSINT, SOCMINT, ADINT, DARKINT, and increasingly, AI-assisted reconnaissance.
- Business Email Compromise, a social engineering-driven crime, cost victims a reported 6.3 billion dollars in the US in 2024 alone, per FBI IC3 data cited in the Verizon 2025 DBIR.
- The most effective defence is not more phishing training alone. It is reducing the amount of exploitable information about your organisation that sits in the open and monitoring it continuously.
The Attack Doesn’t Start With an Email. It Starts With Research.
Most security awareness programs train employees to spot a suspicious message. Fewer organisations ask where the attacker got the details that made the message convincing in the first place.
Social engineering succeeds because it exploits trust, not technical vulnerabilities. And trust is easiest to exploit when the attacker already sounds like they belong. That familiarity is built during a reconnaissance phase that happens entirely outside your network, often weeks before the first malicious message is sent.
The Four Stages of a Social Engineering Attack
1. Information Collection
The attacker builds a profile of the target: job title, reporting lines, communication style, vendors, recent projects, even personal interests. This stage is quiet and largely undetectable from inside the organisation, because none of it touches your systems.
2. Trust Building
Armed with accurate details, the attacker makes contact. This could be a LinkedIn connection request, a follow-up to a real conversation the target had publicly, or an email that references something only an insider or a well-researched outsider would know.
3. Manipulation
The attacker asks the target to take an action: click a link, approve a payment, share credentials, or reset a password. Because the setup feels legitimate, the request rarely triggers suspicion.
4. Utilization
The attacker uses whatever was obtained, credentials, financial access, system footholds, to execute the actual breach or fraud.
The first stage is the one most organisations have the least visibility into, and it is also the one most within their control to shrink.
The Five Sources Attackers Use to Profile Your Organisation
OSINT (Open-Source Intelligence)
Publicly available data about your company and employees: exposed IT assets, open ports, email address formats, leaked credentials, and known vulnerabilities in your websites or IoT devices. Attackers use dedicated OSINT tooling to compile this automatically, at scale, without ever touching your network.
SOCMINT (Social Media Intelligence)
A subset of OSINT worth calling out on its own. Job changes, project announcements, family details, and workplace photos shared on social platforms give attackers the raw material for a convincing pretext. Tools built for social media analysis make it fast to map an employee’s network and habits.
ADINT (Advertising Intelligence)
Mobile apps routinely pass user data, IP addresses, device types, carriers, and GPS locations to ad exchanges in order to serve targeted ads. That data is meant to sell products. It can also end up for sale to parties with less benign intentions, giving attackers granular location and behavioural data on specific individuals.
DARKINT (Dark Web Intelligence)
Stolen credentials, corporate data, and personal records are actively bought and sold on dark web marketplaces. An attacker does not need to breach you directly if your employees’ credentials are already available for purchase from a previous, unrelated breach.
AI-Assisted Reconnaissance
Generative AI tools have shortened the research phase considerably. Publicly reported malicious AI variants can compile and structure target intelligence in a fraction of the time manual OSINT research would take and can help draft highly personalised lures that mimic an organisation’s actual writing style.
Why This Matters at the Budget Table
Security leaders do not need to speculate about the scale of this problem. The data is already public.
The Verizon 2025 Data Breach Investigations Report found that the human element was a factor in approximately 60% of confirmed breaches, a figure that has held steady year over year. Business Email Compromise, which relies entirely on social engineering rather than malware, resulted in a reported 6.3 billion dollars in losses in the United States in 2024, based on roughly 19,000 complaints to the FBI’s Internet Crime Complaint Center.
These are not edge cases. Social engineering consistently ranks among the top attack patterns across finance, education, healthcare, and manufacturing, according to the same report.
For a CISO building the case for investment in this area, the argument is straightforward: the entry point for a large share of breaches is not a firewall gap. It is information your organisation is already, unknowingly, making available.
How to Reduce Your Exposure
The common thread across all five intelligence sources above is that they rely on information your organisation did not intend to expose but has, in some form, made available. Reducing that exposure is the most direct way to blunt social engineering attacks before they reach an inbox.
Run regular, realistic phishing simulations. Training that only covers generic phishing examples does not prepare staff for a pretext built from real, specific details about them.
Set clear AI usage policies. Define what employees can and cannot input into public AI tools, particularly proprietary data, code, or client information, and establish a process for verifying unusual requests before acting on them.
Monitor your own exposure the way an attacker would. Use OSINT and dark web monitoring to continuously check what is publicly discoverable about your organisation, its leadership, and its infrastructure, and treat this as an ongoing process rather than a one-time audit.
Prioritise the employees most likely to be targeted. Executives, finance teams, and IT administrators typically carry disproportionate risk and deserve more frequent, targeted attention than a general annual training session provides.
Cybersecurity built only around perimeter defence misses where most of these attacks actually begin. Closing the gap starts with knowing exactly what an attacker would find if they researched your organisation today.
If you want a clear picture of what an attacker could currently find about your organisation and how to close that gap before it is used against you, [schedule a demo with Innefu’s threat intelligence team].
Frequently Asked Questions
1. What is the first stage of a social engineering attack?
Information collection. Attackers gather publicly available data about the target organisation and its employees before making any contact, which is what makes the later stages convincing.
2. What is the difference between OSINT and SOCMINT?
SOCMINT is a subset of OSINT focused specifically on social media platforms. OSINT covers all publicly available information, including technical infrastructure, leaked credentials, and website vulnerabilities, while SOCMINT covers what people share about themselves on social platforms.
3. Can social engineering attacks be fully prevented with employee training alone?
No. Training reduces susceptibility but does not address the underlying issue, which is how much exploitable information about your organisation is publicly available. Reducing that exposure through continuous monitoring is equally important.
4. How much do social engineering-driven attacks like BEC actually cost organisations?
In the United States alone, Business Email Compromise resulted in a reported 6.3 billion dollars in losses in 2024, according to FBI IC3 data cited in the Verizon 2025 DBIR.
5. Why is AI making social engineering attacks harder to detect?
AI tools can compile target research faster than manual methods and help draft messages that closely mimic an organisation’s real communication style, making the resulting lures harder for both employees and filters to flag as suspicious.
