People Are the Attack Surface
Why break the encryption when you can ask someone nicely?
The idea
Attackers usually persuade someone with access rather than defeat the technology protecting it.
In the real world
A call to a help desk requesting a password reset for a named employee.
Going deeper
Technical controls raise the cost of the technical route, which pushes attackers toward whatever is now cheapest. Usually that is a person with access who can be persuaded under pressure.
A company with strong encryption, patching and enforced two-factor being breached through a help desk call is not evidence the controls were wasted — it is evidence they worked, which is why the attacker went around them. The implication is that access-granting processes deserve the same design attention as systems: verification steps, callbacks, and permission to refuse a plausible-sounding request.
Where it stops applying
Training alone has limited durable effect and blaming individuals for well-executed social engineering is both unfair and unproductive. Process design outperforms vigilance.
Why it matters
It explains why organisations with strong technical controls are still compromised.
Try this today
Ask how someone would reset your account if they claimed to be you.
Test yourself
A company has strong encryption, patched systems and enforced two-factor, and is breached through a help desk call. Was the security wasted?
Show the answer
No, it worked — which is why the attacker went around it. Controls push attackers toward the cheapest remaining route, and a human who can grant access under pressure is usually cheaper than any cryptographic attack.
Learn this in the feed Answering from memory, then again days later, is what makes it stick.