Why Are Companies Struggling to Prevent Social Engineering Attacks?

Why Are Companies Struggling to Prevent Social Engineering Attacks? | Opinion

Social engineering attacks remain a significant threat in the crypto space, rooted in human behavior rather than technology alone. Despite massive investments in cybersecurity measures, companies often overlook operational security, making them vulnerable. With the rise of decentralized finance (DeFi) and the irreversible nature of crypto transactions, this issue has become even more pressing. Effective responses require better training and a strategic shift towards operational security.

Key Takeaways

Most major crypto hacks target human factors, not cybersecurity flaws.
Social engineering accounts for about 60% of data breaches, exploiting trust and human behavior.
The irreversible nature of crypto transactions heightens the risks associated with social engineering.
Organizations must prioritize operational security and employee training to combat these attacks.
The growing sophistication of AI tools makes social engineering threats increasingly alarming.

Social engineering will not disappear, but we can make it far less effective and far less catastrophic when attacks occur.

The Human Factor in Cybersecurity

Over the last year, many of the biggest exploits in the cryptocurrency world have stemmed from one primary cause: people. Just within recent months, Ledger advised users to stop on-chain activities after npm maintainers fell victim to deceptive schemes, Workday reported a social-engineering campaign that breached a third-party CRM, and North Korea-affiliated operators continued to use fake job postings to deliver malware.

Despite companies pouring billions into cybersecurity, they keep falling prey to simple social engineering tactics. While significant resources are devoted to technical safeguards, audits, and code reviews, many organizations often overlook essential elements of operational security, device maintenance, and fundamental human factors. The increasing shift towards on-chain financial activities amplifies this oversight, creating systemic risks to digital infrastructure.

Social Engineering: A Cybersecurity Weakness

According to Verizon’s 2025 Data Breach Investigations Report, the "human element" accounts for approximately 60% of data breaches through methods such as phishing, stolen credentials, and simple mistakes. Social engineering succeeds because it exploits human emotions like trust, urgency, and familiarity rather than attacking computer code. Such exploits cannot be neutralized through code audits and are challenging to prevent with automated cybersecurity solutions. Even tech-savvy teams can fall victim; after all, human error is universal. Consequently, incidents driven by social engineering continue to occur in the real world.

The High Stakes of Cryptocurrency

In the world of cryptocurrency, the stakes are considerably higher. In a decentralized environment like web3, compromising a seed phrase or API token is akin to breaching a bank vault. The irreversible nature of crypto transactions amplifies the impact of mistakes; once funds are transferred, reversing the transaction is often impossible. A single error in device security or key management can result in significant losses. The decentralized framework of web3 often means there is no support system, leaving users to manage issues independently.

Hackers, including those supported by state actors, have recognized the effectiveness of social engineering and adapted their strategies accordingly. Operations attributed to North Korea’s Lazarus Group heavily leverage social engineering tactics such as fake job offers and meticulously crafted phishing attempts that exploit human vulnerabilities. These methods are alarmingly effective and easy to implement, while tech firms struggle to defend against them. Unlike zero-day exploits, which are often patched quickly, social engineering techniques can be reused by hackers, allowing them to focus more on actual hacking rather than spending time on research and development.

Necessity for Investment in Operational Security

Numerous organizations still view security as merely a compliance requirement—a mindset that is supported by lenient regulatory standards. Companies frequently pass audits and issue impressive reports while simultaneously harboring significant operational risks, such as storing administrator keys on personal devices and sharing credentials through unsecured channels.

To rectify this lack of diligence, companies must adopt and enforce robust operational security practices. This includes using managed devices, implementing strong endpoint protection, and employing full-disk encryption. Company accounts should utilize password managers and phishing-resistant multi-factor authentication (MFA), and access privileges should be meticulously managed. While these controls aren’t foolproof, they do complicate social engineering attacks and minimize potential damages.

Importantly, teams also need to invest in operational security training. Employees, not just cybersecurity professionals, serve as the first line of defense against these attacks. Organizations should focus on teaching their teams how to identify phishing attempts, maintain safe data practices, and understand operational security better.

Crucially, expecting organizations to voluntarily strengthen their cybersecurity posture is unrealistic; regulators must intervene by establishing enforceable operational standards. Compliance frameworks should evolve past mere documentation, demanding concrete proof of secure practices including verified key management and periodic access reviews. Without regulatory enforcement, the tendency will always be to prioritize appearances over effective security.

The Escalating Threat of Social Engineering

Investing in operational security is imperative now since the frequency of attacks is on the rise. Generative AI has transformed the dynamics of deception, allowing attackers to customize and automate phishing tactics on a massive scale. Campaigns that once targeted individual users can now easily extend to thousands of businesses with minimal additional effort. Phishing attempts can be personalized using intimate details to make fraudulent emails appear genuine.

AI also accelerates the reconnaissance phase. By mining publicly available information, leaked credentials, and open-source intelligence, attackers can compile detailed profiles of victims, leading to highly convincing assaults.

Mitigating the Frequency of Attacks

Social engineering flourishes in environments where implicit trust and convenience prevail over verification and caution. Organizations must adopt a more defensive approach and correctly assume they are perpetually at risk of social engineering attacks.

Teams should embrace zero-trust principles and integrate operational security measures across the organization. Employee training on operational security is essential to intercept potential attacks early and keep personnel informed about the latest social engineering tactics.

Ultimately, businesses need to identify areas in their operations where trust is present and enhance safeguards around these vulnerabilities. Although social engineering will not completely vanish, we can significantly reduce its effectiveness and catastrophic outcomes when attacks occur. As the industry strengthens its defenses, social engineering will become less appealing to hackers, gradually decreasing the frequency of attacks and potentially breaking the relentless cycle of exploits.