Closing the doors just walked throughΒΆ
Having demonstrated how social engineering attacks succeed, the natural follow-on question is what, if anything, can actually stop them. The answer is less satisfying than most security teams would like. You cannot train humans out of being human, and most controls that work against opportunistic attacks will slow down but not stop a determined adversary who has done their reconnaissance properly.
Even so, some defences are substantially better than others, and a few of the most commonly recommended controls are close to useless against current techniques. The distinction is worth attention.