Beyond Phishing – Building & Sustaining a Corporate SE Program

### Moving Beyond Commoditized Phishing At 00:00, the speakers open the session by examining the limitations of conventional corporate social engineering programs. While basic email phishing simulations have become standard compliance requirements, they rarely prepare an organization for sophisticated adversaries who combine multiple attack channels to compromise corporate networks.

### Scoping and Operationalizing Internal SE Assessments At 06:00 and 12:01, the presenters discuss the operational mechanics of establishing a mature internal social engineering program. They emphasize aligning simulated attack scenarios with actual adversary tactics documented in industry breach reports, establishing clear rules of engagement with executive leadership, and carefully navigating employee privacy concerns.

### Multi-Modal Attack Pretexts: Vishing and Physical Infiltration At 18:15, the discussion expands to multi-modal engagements, focusing on voice phishing (vishing) and physical security assessments. The speakers illustrate how attackers exploit human helpfulness over telephone pretexts to harvest two-factor authentication codes and bypass reception desks to execute unauthorized physical walk-throughs.

### Tactical Baiting: Realistic USB Drops At 24:02, the presenters evaluate USB drop campaigns. They caution against using expensive, recognizable testing hardware like Rubber Duckies, advocating instead for inexpensive, realistically branded flash drives loaded with benign tracking macros to accurately measure employee curiosity and drive-insertion rates.

### Fostering a Reporting Culture vs. Punitive Metrics Concluding at 30:02, the talk highlights the psychological dimension of enterprise defense. Treating employees who fall for simulations punitively breeds resentment and concealment; organizations must incentivize rapid reporting and transparent communication to transform employees into active defensive sensors.

(AI summary — Gemini Flash)