Helping clients meet their business challenges begins with an in-depth understanding of the industries in which they work. That’s why KPMG LLP established its industry-driven structure. In fact, KPMG LLP was the first of the Big Four firms to organize itself along the same industry lines as clients.

How We Work

We bring together passionate problem-solvers, innovative technologies, and full-service capabilities to create opportunity with every insight.

Learn more

Careers & Culture

What is culture? Culture is how we do things around here. It is the combination of a predominant mindset, actions (both big and small) that we all commit to every day, and the underlying processes, programs and systems supporting how work gets done.

Learn more

Social engineering

A fatal flaw in cybersecurity

Managed services offers consistent testing for social engineering

A key way to protect critical infrastructure is with layered controls in front of sensitive assets. But these technical protections won’t matter if a bad actor still can gain access to one of the most sensitive assets of all: your users.

To help prevent social engineering or the method of gleaning information from your user base, you can introduce guardrails such as data loss prevention (DLP), proper network segmentation, and a robust identity and access management (IAM) infrastructure. Still, a determined attacker can exploit these controls, and some privileged users with access can natively subvert them.

To reduce risk, it’s wise to build your organization’s awareness of common social engineering attacks, while consistently testing for vulnerabilities:

  • Vishing. In this method of attack, short for “voice phishing,” a bad actor uses the phone to coerce a user to divulge sensitive information.
    Why test for it: Running your users through vishing scenarios can help them identify ways they might be approached over the phone. For example, hacker groups like Scattered Spider are known to call help desks, posing as legitimate users in an effort to steal documents and intellectual property.
  • Smishing. Short for “SMS phishing,” smishing is the sending of malicious text messages.
    Why test for it: Smishing scenarios are highly covert, may not appear malicious, and usually do not immediately seek sensitive information. Instead, hacker groups focus on building rapport with users before asking them to visit legitimate-looking websites, which are designed to steal mobile phone data such as subscriber identity module (SIM) information.
  • Physical breach: In this attack, a bad actor circumvents building controls, such as badge readers and man traps, to approach employees on an organization’s physical estate.
    Why test for it: Controls such as DLP, antivirus, IAM and network segmentation assume that attackers operate remotely. But if an attacker can physically walk up to someone, they immediately bypass these controls.  
  • Spear phishing. Referring to targeted social engineering, this method seeks to go after a specific user group, such as an IT administrator team. It can take the form of any of the methods described above.
    Why test for it: In addition to help desks, Scattered Spider commonly uses spear fishing to attack C-suite executives, administrative professionals, and even the family members of these groups. The typical mechanisms are tailored emails and chat messages, aiming to compromise single-sign-on credentials and security tools without using malware.

Attackers are constantly evolving their exploitative techniques, so even the most knowledgeable users are susceptible to social engineering. That’s why progressive companies are engaging managed services providers with cybersecurity capabilities that evolve at the pace of threats. The best providers offer consistent testing and education to help harden your user base against attack.

How KPMG can help

KPMG offers end-to-end security testing as an outcome-based managed service, helping you consistently validate controls while minimizing remediation efforts. That’s because business transformation is not a fixed destination; it’s an ongoing journey. With managed services, we help you continually evolve your business functions to keep up with ever-changing targets, while driving outcomes like cost reduction, resilience, and stakeholder trust. Learn more.

Meet our team

Image of Evan Rowell
Evan Rowell
Specialist Director, Market Development , Advisory, KPMG US

Subscribe to Going Beyond: Managed Services

See our latest thinking on how managed services can help you drive transformation at the speed of business.

Explore other services tailored to your business

Thank you!

Thank you for contacting KPMG. We will respond to you as soon as possible.

Contact KPMG

Use this form to submit general inquiries to KPMG. We will respond to you as soon as possible.

By submitting, you agree that KPMG LLP may process any personal information you provide pursuant to KPMG LLP's Privacy Statement.

An error occurred. Please contact customer support.

Job seekers

Visit our careers section or search our jobs database.

Submit RFP

Use the RFP submission form to detail the services KPMG can help assist you with.

Office locations

International hotline

You can confidentially report concerns to the KPMG International hotline

Press contacts

Do you need to speak with our Press Office? Here's how to get in touch.