Social Engineering: What Scanners Miss

Automated scanners find vulnerabilities in software. They cannot find the employee who will hand over credentials to a convincing phone call.

Published June 12, 2025 by Megan Fulton.

Category: Security

The most expensive security incident most organizations will ever experience will not begin with a software vulnerability. It will begin with a phone call. An email. A text message that appears to come from a colleague. Social engineering is the entry point for a disproportionate share of significant security incidents, and it is systematically undertested in most security programs.

Automated scanners do not test people. Penetration tests that focus exclusively on technical vulnerabilities leave the human attack surface unassessed. Organizations that run only technical testing have a partial picture of their security posture — and the missing dimension is frequently the one that attackers exploit most effectively.

Why Social Engineering Is Undertested

Social engineering testing requires different expertise, different methodology, and different organizational coordination than technical penetration testing. It involves simulating real-world attack scenarios — phishing campaigns, vishing attacks, pretexting — that test how people respond to manipulation attempts rather than how systems respond to technical attacks.

Many organizations avoid social engineering testing for two reasons. First, it feels uncomfortable to test employees rather than systems — particularly when it reveals how many people respond to well-crafted attacks. Second, the results require organizational responses — training, policy changes, process modifications — that technical vulnerability findings do not always demand.

What Social Engineering Testing Finds

• Phishing susceptibility: what proportion of personnel respond to credential-harvesting or malware-delivering email campaigns
• Vishing vulnerability: whether personnel can be manipulated into disclosing sensitive information or granting access via phone
• Physical security: whether physical access controls can be bypassed through pretexting or tailgating
• Credential hygiene: whether social engineering can be used to identify or obtain credentials
• Incident reporting gaps: whether successful attacks are reported through appropriate channels

Integrating Social Engineering Into Security Programs

Effective social engineering testing is not a one-time engagement conducted to check a compliance box. It is an ongoing program that tracks organizational improvement over time, correlates with training and awareness programs, and provides real data about the human dimension of the organization's security posture.

VioletX Vx Test includes social engineering assessment capabilities that go beyond phishing simulations to test the full range of human attack vectors that sophisticated adversaries actually use. The findings from social engineering testing are integrated with technical findings to provide a complete picture of the organization's exposure.

The Connection to Compliance

Social engineering and security awareness are control requirements under SOC 2, ISO 27001, HIPAA, and CMMC. Frameworks require not just that organizations train personnel on security awareness, but that they test the effectiveness of that training. Social engineering assessments provide the evidence that training programs are producing behavioral change — a level of proof that attendance records alone cannot provide.

Read the full article on VioletX