History

Vishing attacks have existed since the early 1990s and continue to grow in popularity because they work. Even seasoned employees can be compromised by a skilled social engineer, which can lead to the disclosure of sensitive information, such as credentials, trade secrets, account data, or personally identifiable information. Some of history's most significant data breaches have started with a successful social engineering attack. All the technical controls that you have put in place against cyber attacks are moot if a bad actor can exploit the human element instead.

The effectiveness of vishing stems from both the predictability of customer- or member-facing employee behavior, paired with the unpredictability of third parties or other stakeholders in how they interact with your employees. Vishing attackers are planning on your employees to approach the interaction with social mores and acceptable conduct in mind. The bad guys are counting on your employees to be polite, helpful, and accommodating; they will use tactics like building urgency and setting stakes for the situation (e.g., “I got a notification that my account is overdrawn” or “I have a work order from your supervisor to conduct this test”). Malicious actors also have no shame in tugging on your employees’ heartstrings and relying on sympathy to get what they want (e.g., “My mother is in the hospital, and I need to check her account balance” or “It’s been a long day, and you’re the last employee on my list to confirm this information”). Our vishing simulations will incorporate these same real-world tactics to test your employees who are walking the tightrope between being cooperative and being compromised.