Closing the doors just walked through¶

Having demonstrated how social engineering attacks succeed, the natural follow-on question is what, if anything, can actually stop them. The answer is less satisfying than most security teams would like. You cannot train humans out of being human, and most controls that work against opportunistic attacks will slow down but not stop a determined adversary who has done their reconnaissance properly.

That said, some defences are substantially better than others, and a few of the most commonly recommended controls are close to useless against current techniques. The pages here try to be honest about the distinction.