Social Engineering Attack Effectiveness Across Modalities: Email, Voice, SMS, and Social Media

What Did This Cybersecurity Research Find?

This cybersecurity human factors study conducted authorized social engineering tests across four attack modalities at 20 organizations (total 10,000 employees). Cybersecurity social engineering via voice calls (vishing) achieved a 47% success rate, compared to 31% for SMS (smishing), 18% for email phishing, and 12% for social media, with vishing effectiveness driven by urgency cues and impersonation of authority figures.

Key Findings

• 1Vishing had the highest success rate at 47%, followed by smishing at 31%
• 2Email phishing succeeded at 18%, the lowest among direct contact methods
• 3Social media social engineering succeeded at 12% but had the widest reach per effort
• 4Urgency and authority impersonation were the most effective psychological triggers across all modalities
• 5Security awareness training reduced vishing success from 47% to 19% in trained groups

How Does This Apply to Cybersecurity Careers?

Security awareness trainers should shift focus toward vishing defenses given its higher success rate. Red team operators can select the highest-yield social engineering modality for their assessments.

Who Should Read This?

Frequently Asked Questions