Skip to main content

In leadership, as in social engineering, the greatest obstacle to obtaining ground-truth intelligence is The Filter. This is the natural human tendency to sanitize information when speaking to authority.

When you ask a direct question, you trigger the employee’s analytical mind. They weigh the consequences of their answer, leading to “compliance” rather than “truth.” To get past this, I use elicitation, the practice of triggering subconscious psychological responses to gather data.

Here are three advanced frameworks to move beyond the presumptive statement that I spoke about in my LinkedIn Article.

1. The Quid Pro Quo (Reciprocal Exchange)

The Trigger: Reciprocity. Humans have an innate desire to balance the social ledger. If you provide a “gift” of information, specifically information that seems confidential or vulnerable, the employee feels a psychological debt to return the favor.

  • The Script: “To be honest, I felt like the transition to this new platform was a mess on my end last quarter; I felt totally blind. How has the learning curve been for your team?”
  • The Mechanics: By “confessing” a struggle, you make it safe for them to drop the facade of perfection.

CAUTON:

  • What you tell them must be the truth, lying to get information is unethical
  • Don’t overplay the struggle if it wasn’t real, that will ruin trust when you are caught out.

2. The Columbo Approach (Naïvety & Flattery)

The Trigger: The Teacher Instinct / Professional Ego. People love to be the expert. When you position yourself as slightly less informed than you actually are, you trigger a “corrective” or “mentoring” response in the employee.

  • The Script: “I saw how you handled that vendor negotiation and I thought it was impressive. I’m still trying to wrap my head around the logic of the integration, though. How did you actually get them to agree to those terms?”
  • The Mechanics: By asking “how” from a position of “learning,” the employee will often reveal the internal “why” and technical details they would normally keep guarded.

CAUTION:

  • Never use flirtation tactics, they are unprofessional and are not signs of a strong leader
  • The flattery used must be real, honest, and professional

3. The Bracket

The Trigger: The Desire for Specificity. Humans often feel uncomfortable with vague generalities when they possess specific knowledge. By providing a “bracket” (a high and low range) that you know is likely incorrect, you force the person to narrow that bracket down for you.

  • The Leadership Play: Instead of asking, “What is the budget overrun on this project?” try: “I’m assuming we’re looking at a pretty massive hit here, probably somewhere between $50k and $100k?”
  • The Mechanics: By setting the “high” end of the bracket at a level that sounds alarming, you trigger a “relief response.” The employee corrects you with the real number to prove the situation isn’t as catastrophic as your bracket suggests.

Operational Notes:

  1. Lower the Cognitive Load: Use these during “water cooler” moments or at the end of meetings when the employee thinks the “official” business is over.
  2. The Pause: After using a presumptive or false choice statement, wait. Silence is a vacuum that the employee will feel compelled to fill.
  3. Remember Active Listening is an essential skill.
  4. No Congratulation: If they give you the data, don’t celebrate. Accept it as part of the natural conversation flow to keep the elicitation cycle open.
Security Assessment Case Study
Learn more about the importance of a Social Engineering Risk Assessment.
Security Assessment Case Study
Learn more about the importance of a Social Engineering Risk Assessment.
What Makes Us Different
At Social-Engineer, we pride ourselves on what we do and how we do it. We are a security services provider, focusing on four primary attack vectors. This case study will go through how we can protect your company and what makes us different.
What Makes Us Different
At Social-Engineer, we pride ourselves on what we do and how we do it. We are a security services provider, focusing on four primary attack vectors. This case study will go through how we can protect your company and what makes us different.
Woman vs Machine
Technology is providing new, more innovative ways to enhance our world. Scientists are constantly developing smarter, faster and more intelligent machines, systems and robots. There is no doubt that each of these has evolved beyond their clockwork origins.
Woman vs Machine
Technology is providing new, more innovative ways to enhance our world. Scientists are constantly developing smarter, faster and more intelligent machines, systems and robots. There is no doubt that each of these has evolved beyond their clockwork origins.
Vishing and Phishing Must Be Ongoing to Be Effective
Most companies have a security awareness program in one form or another. If they don’t, it should be on the short list of programs to start as soon as possible. In our experience, many of these programs take the form of computer-based training.
Vishing and Phishing Must Be Ongoing to Be Effective
Most companies have a security awareness program in one form or another. If they don’t, it should be on the short list of programs to start as soon as possible. In our experience, many of these programs take the form of computer-based training.
A Case Study in Vishing
Vishing (voice-based phishing) has been a problem for quite a long time. There are many vendors in the marketplace that offer vishing services. However they tend to use robo-callers or call centers for large volume engagements. If they are using trained humans to make calls, it is likely in very low numbers.
A Case Study in Vishing
Vishing (voice-based phishing) has been a problem for quite a long time. There are many vendors in the marketplace that offer vishing services. However they tend to use robo-callers or call centers for large volume engagements. If they are using trained humans to make calls, it is likely in very low numbers.
Benefits of a Social-Engineering Risk Assessment Engagement
Your company is important. Indeed, the data you hold for your clients or employees is very valuable and attackers seek to capitalize on that data any way they can. This is where a Social Engineering Risk Assessment (SERA) engagement can help uncover possible vulnerability to attackers.
Benefits of a Social-Engineering Risk Assessment Engagement
Your company is important. Indeed, the data you hold for your clients or employees is very valuable and attackers seek to capitalize on that data any way they can. This is where a Social Engineering Risk Assessment (SERA) engagement can help uncover possible vulnerability to attackers.
The Business Value of the Social-Engineer Phishing Service
Cybercriminals are targeting the human element of organizations. Additionally, they are developing techniques to use an organization’s employees as the first point of entry. According to the 2021 Verizon DBIR report, of the 3,841 security breaches reported using social engineering, phishing was the key vector for over 80% of them.
The Business Value of the Social-Engineer Phishing Service
Cybercriminals are targeting the human element of organizations. Additionally, they are developing techniques to use an organization’s employees as the first point of entry. According to the 2021 Verizon DBIR report, of the 3,841 security breaches reported using social engineering, phishing was the key vector for over 80% of them.