What is Pretexting?
Pretexting is a social engineering technique in which an attacker invents a believable scenario, the pretext, and plays a role inside it to obtain information or access. The attacker might pose as an IT technician, a new hire, an auditor or a supplier, and the story gives the target a reason to help instead of a reason to doubt.
Definition
- Pretexting
- Pretexting is a social engineering technique in which an attacker invents a believable scenario, the pretext, and plays a role inside it to obtain information or access. The attacker might pose as an IT technician, a new hire, an auditor or a supplier, and the story gives the target a reason to help instead of a reason to doubt.
How Pretexting Works
Phishing and pretexting are often lumped together, but they run on different time scales. A phishing email is one message with a link or an attachment. Pretexting is a role the attacker keeps up across several contacts:
- a call to reception to learn who runs IT,
- an email to the help desk that names that person,
- a follow-up call that refers back to the email.
Each step makes the next one look routine. The pretext is the cover story, and the prize is whatever the story unlocks, typically a password reset, an MFA enrollment, a document or a change to payment details.
Help desks are the favorite target, because restoring access is their job
A common modern pattern is a caller who claims to be an employee with a broken phone, knows that employee's name, manager and staff ID from earlier research or breached data, and asks for an MFA reset. Once the help desk registers the attacker's device, the strongest authentication the company owns starts working for the attacker. MITRE ATT&CK covers the information-gathering side as Phishing for Information (T1598), including a voice sub-technique, and the role-playing itself under Social Engineering: Impersonation (T1684.001).
Defending against pretexting means making verification independent of the story
A caller's knowledge of names and ID numbers proves only that they did homework. A call-back to the number on file, approval from the person's manager through a separate channel, or an in-person identity check for credential resets breaks the pattern, because the attacker controls the conversation but not the directory.
Pretexting in SOC Operations
Pretexting rarely trips a detection on its own, so the SOC usually meets it through what follows. Watch for MFA method changes and password resets done by the help desk shortly before a sign-in from a new device, country or hosting provider, and for a new authenticator registered on an account whose owner never asked for one. During the investigation, pull the help desk ticket and call notes next to the identity logs: the timeline of who asked for what, through which channel and with what verification is often the whole case. Share confirmed pretexts with the help desk and with threat intelligence, since the same caller usually tries several employees, or sister companies, with the same script.
Practice Pretexting in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating pretexting scenarios with zero consequences, free.
Frequently Asked Questions
- Is pretexting a type of malware?
- No. Pretexting is a social engineering method, not software. It manipulates a person into handing over information or access, and it often involves no file or link at all, which is why antivirus and email filters miss it. Malware may come later, once the pretext has given the attacker a way in.
- How can I protect myself from pretexting?
- Verify the person through a channel you already trust. If someone asks for credentials, codes, payment changes or sensitive files, end the conversation and call them back on the number in the company directory. Never read out an MFA code to anyone, and report the attempt, because a pretext that fails with you will be tried on a colleague.
- What does "pretexting" mean?
- A pretext is a false reason given to hide the real one. In security, pretexting means building that false reason into a whole scenario: who the attacker claims to be, why they are getting in touch, and why the request is normal or urgent. The quality of the story is what separates pretexting from a crude scam.
Sources
Related Terms
In cyber security, social engineering means manipulating a person into handing an attacker access, i...
Phishing is a social engineering attack delivered via email, SMS, voice calls, or other channels tha...
MFA (multi-factor authentication) is a sign-in check that asks for two or more different kinds of pr...
An insider threat is a security risk originating from current or former employees, contractors, or b...
Incident response (IR) is the structured, repeatable process an organization follows before, during,...
More Threats Terms
Related SOC Training Resources
Threat Hunter Career Guide: Salary & Skills
Threat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathIncident Responder Career Guide: Salary & Skills
Incident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more Career PathSOC Analyst (Tier 2) Career Guide: Salary & Skills
Tier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator vs Hack The Box: Comparison
Different tools for different career paths. SOCSimulator trains defensive analysts. Hack The Box trains offensive securi…
Read more ToolSIEM Training Console: SOCSimulator
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more TechniqueMITRE ATT&CK® Techniques: Detection Training Library
Browse all MITRE ATT&CK® techniques with detection strategies and example alerts.
Read more Career PathCybersecurity Career Paths: 2026 Guide
Explore SOC analyst career paths with salary data, required skills, and certification roadmaps.
Read more PlaybookSOC Investigation Playbooks: Step-by-Step Guides
Practitioner investigation playbooks with decision trees and real SIEM queries.
Read more FeatureShift Mode: Real-Time SOC Simulation
Practice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureOperations: Guided Training Operations
Structured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogSOCSimulator Blog: Security Training Insights
Articles on SOC analyst skills, detection engineering, and career development.
Read more FeatureSOCSimulator Pricing: Free Plan Available
Compare free and Pro tiers.
Read more