Social engineering: hacking the human, not the system

Social engineering is the use of manipulation, rather than technical exploits, to get someone to do something they otherwise wouldn't — hand over information, grant access, or bypass a control. It works because it exploits normal, helpful human behavior: our instinct to be polite, to help colleagues, and to comply with apparent authority.

Attackers don't need to 'hack' a firewall if they can convince a receptionist to prop open a door, or convince a helpdesk agent to reset a password over the phone.