Why Social Engineers Target Busy Adults
Most cyberattacks don’t start with code. They start with a conversation. As we mark Cybersecurity Awareness Month 2026, Dr. Henry Collier, dean of the School of Science and Technology, cybersecurity expert and Army veteran, explains why anyone can be fooled, how AI is raising the stakes and the simple habit that stops most attacks.
I started my journey in cybersecurity more than 30 years ago in the military, where my team was the connecting point between the tactical network and the civilian network. My systems were the gateway to the U.S. Army’s tactical network, and if they were ever compromised, it would have significant operational impacts on the Army’s ability to defend our country. Because of that, the Army sent signals-intelligence warrant officers to work alongside us and help keep the tactical network protected.
My real education started with those warrant officers. We talked about this new thing called “The Internet” and what it meant for our ability to communicate. We asked how it could be used to attack us, how we could use it to defend ourselves and how we could use it to disable our enemies. Those conversations are the reason I chose to become a warrant officer focused on cybersecurity.
From Hacking Code to Hacking People
Today, “cybersecurity” is a word nearly everyone knows. From the Morris Worm in 1988, one of the first major cyberattacks, to today’s targeted attacks aimed at gaining access to systems, stealing data or stealing money, cybersecurity affects all of us.
In the early years of computing, most people associated cyberattacks with someone hacking into a system by exploiting a software vulnerability. Over time, however, threat actors realized that finding and exploiting those vulnerabilities was a time-consuming venture, especially as organizations strengthened their defenses and software manufacturers began releasing security fixes and updates.
Finding a vulnerability in a system and taking advantage of it can take anywhere from days to years. In most cases, it also takes a team of hackers working together. So, threat actors turned to a form of attack that isn’t really new, just repurposed: social engineering.
The easiest way into a system is to be invited.
What is Social Engineering? Lessons From the Trojan Horse
Social engineering is the practice of manipulating someone to do something they otherwise would not do. Threat actors have put a lot of effort into understanding the psychology behind a successful attack.
One of the most famous examples in history is the Trojan horse from the Odyssey.
In mythology, the Greek army, led by Odysseus, needed to find a way into the city of Troy. They built a giant wooden horse and left it as a trap for the Trojans. Believing they had defeated the Greeks, the Trojans brought the horse into their city as a war trophy, even though priests and others warned it was a trick.
But Greek soldiers had hidden themselves inside the horse and slipped out during the night to open the Trojan gates so the soldiers could sack the city and end the 10-year war.
It’s no coincidence that a type of malware is named after the Trojan horse. The Greeks used many modern psychological tactics against the Trojans, including the desire to end the war, confirmation bias, goodwill, authority, social proof and hubris. The lesson is still relevant today.
The Psychology Behind the Attack
In my work, I handle the technical side of attack and defense, but social engineering is what really intrigued me. The psychological side of these attacks is what drew me in. During my time in academia, I have conducted a variety of research studies to understand social engineering more deeply and to identify better ways to defend against it.
The cybersecurity community developed information assurance training, a training solution. But I argue that’s the wrong approach: There is no technical solution that will stop a bad decision. It’s about having the right mindset for an attacker to take advantage of, or the right mindset to stop the attack. Everyone is vulnerable. It only takes the right time, the right mental state and the right attack. Even I am vulnerable, and this is my area of expertise.
Threat actors have learned what makes someone more likely to fall victim. They use psychological markers like authority, urgency, fear, trust, timing, reciprocity, curiosity, greed and social proof to entice and trick you into acting on their requests.
Why Your Social Media is a Gold Mine for Attackers
Social engineers also use people’s social media against them. If I was a threat actor and identified a potential target, the first thing I’m going to do is scrape their social media to learn their needs, wants and habits so I can use them against them. It’s exceptionally easy, because people put their entire lives online.
Let’s say I’m targeting someone who works in government, and I see they’ve posted about a loved one passing away. They’re in a vulnerable place and likely not thinking about security. I’m going to develop an attack that pulls on their heartstrings and uses their emotions against them. Human beings make decisions based on emotions, so by attacking when someone is vulnerable, I increase my odds of success.
Social media is one of the best gold mines for collecting data about individuals and developing effective attacks. The more an attacker knows about you, the better their chances.
Why Busy Adults Face Greater Risk
Students can be especially vulnerable to social engineering attacks because they’re in a unique place in life. They’re juggling coursework, deadlines and everything else that comes with earning a degree. TESU students often have even more on their plates. Most are working adults with careers and families, and every added responsibility makes life more complex. The busier and more distracted you are, the more vulnerable you become.
Pause and Verify: Your Best Line of Defense
Let’s talk about defensive strategies for a moment.
As a cybersecurity specialist, I have developed a mindset of questioning everything that comes in digitally. Before I click on any links or even respond, I’m going to verify that it’s legitimate.
A few years ago, I received an email that appeared to come from my dean. On the surface, it looked authentic, except it was asking me a question that made no sense: “Are you on campus?”
I had literally seen the dean that morning, so I texted the dean to check. He confirmed he hadn’t sent it at all, so I forwarded the email to our security team.
A note: Because I was using an older phone, I couldn’t see the phony address the email came from. Had I opened it on my computer, I would have spotted the discrepancy immediately.
What I did is known as “Pause and Verify.”
Rather than acting immediately to the request or responding, you intentionally do nothing. Then, you verify the authenticity of the request by contacting the sender in a different way, such as a phone call, text or new message. Never reply to a message you are unsure about.
This can be difficult when you’re busy, overwhelmed or facing a sense of urgency. It’s in our nature to simply respond and get it off our to-do list. But most social engineering attacks can be stopped because someone paused and verified before proceeding.
How AI is Making Social Engineering More Convincing
Historically, social engineering attacks have seen around 90% attack success. With AI, we are seeing that number rise to 98% success.
Since the introduction of artificial intelligence, we have seen a concerning increase in the effectiveness of social engineering attacks. Threat actors have learned to use AI to develop their attacks, and the results are significantly more convincing.
For example, at a conference I was presenting at, I showcased a sample of an attack I had created using AI. The ad offered free coffee and donuts to the incoming class, enticing students to click through. The security professionals at the event commented that the ad was so convincing, they would have fallen for it when they had been students.
AI, Voice Cloning and the Grandparent Scam
AI’s ability to clone voices has led to a significant increase in successful vishing (voice phishing) attacks. The grandparent scam in particular has become noticeably more effective.
Where before, an attacker would have to call an elderly person themselves to run the scam, attackers can now clone a person’s voice from only 20 seconds of a TikTok video and use that to call the elderly person. Instead of hearing a stranger’s voice on the other end of the line, the grandparent hears the voice of their grandchild.
To defend against this, I recommend employing a safe word that only your family members know to ask for when calling. Just make sure the safe word never appears on social media in any form.
When in Doubt, Reach Out
As social engineering attacks grow more sophisticated, it’s more important than ever to take precautions. If you’re a TESU student and you receive an email from TESU offering something or asking for information, reach out to the sender directly to confirm it’s legitimate before you do anything else.
Here at TESU, we want you to be safe and successful in your academic journey. We would much rather have you reach out and question something than fall victim to an attack.
Be safe, be vigilant!
Curious about the work that goes into stopping attacks like these? TESU offers a Bachelor of Science in Cybersecurity, a Master of Science in Cybersecurity and a Graduate Certificate in Cybersecurity, all designed for busy adults and all available online. Learn more about our cybersecurity programs here.