Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

The Psychology of Phishing

8 Jan 2025 · 1 min

Watch on YouTube

0:49

In this segment, the speaker argues that technical knowledge alone does not protect individuals from social engineering attacks because such attacks are designed to bypass logical, analytical thinking and instead trigger emotional reactivity. The core strategy of phishing and other social engineering tactics is to hijack attention and focus, exploiting situational awareness and threat perception. The speaker identifies three primary emotions—fear, urgency, and anxiety—as the most powerful drivers of behavior change in manipulation contexts. Consequently, building resilience requires targeting emotional regulation, enhancing attention, situational awareness, and threat perception rather than relying solely on technical expertise.

Chapters

The technical knowledge about something does not build the resilience because the whole point of social engineering is the fact that you override logical analytical thinking and you move into emotional reactivity. No matter how much logical analytical information I have, the whole point is to override that and, and harness my emotional reactivity. So we have to target emotional reactivity. So attention and focus, situational awareness, threat perception levels. We also have something that's very fundamental, which is emotional regulation, because fear, urgency, anxiety— these are the three things that are the emotions that drive max, most effective behavior change, especially from a manipulation standpoint and social engineering standpoint.