// GLOSSARY

Vishing (Voice Social Engineering)

A form of social engineering carried out over the phone or a voice channel, usually targeting help desk and identity verification processes (voice + phishing). In the Social Engineering Simulation it is treated as a separate entry surface, because it exercises a reflex different from the one email-based simulations measure. In an email-based phishing attempt the victim has time to think, to examine a link, to ask a colleague; in voice contact this room disappears. The voice on the other end of the line establishes an immediate pressure, creates a sense of urgency, and makes it socially hard to say 'let me think for a minute'. The persuasive power of the human voice and the pressure to improvise often disable the cautious reflexes that engage in written communication. So an organization succeeding in its email simulations does not mean it is resilient against a voice attack; the two surfaces must be tested separately. Password-reset and account-recovery processes in particular are the most fragile points: a help-desk employee, unable to verify the caller's identity face to face, can come under pressure to grant a critical authority based only on a voice and the story being told.