For years, our industry has treated “blocking” as the gold standard. If the email didn’t land, if the malware didn’t execute, if the alert fired in the SIEM, we called it a win. That mindset made sense in a world where most attacks came through a handful of familiar doors.
But AI has changed the game. We’re not dealing with hobbyists sending out clumsy phishing attacks anymore. Modern adversaries are running multi‑channel, AI‑assisted businesses at machine speed. And if all you’re doing is blocking at the edge, you’re not really defending. You’re just delaying.
Generative AI has made it trivial to spin up highly personalized, multi‑step social engineering campaigns that operate simultaneously across email, collaboration apps, mobile, social media, and paid media. The result is a social engineering attack chain: a sequence of stages designed to manufacture trust, erode judgment, and bypass brittle controls.
You don’t beat that by tuning another filter. You have to disrupt the attack chain itself. Let’s walk through what that chain looks like and where defenders need to start fighting back.
Anatomy of the Modern Social Engineering Attack Chain
Today’s social engineering is a lifecycle.
I tend to think about it in five stages, each one designed to build credibility, gain proximity to the victim, and convert human interaction into compromise.
Stage 1: Setup
The attack starts long before your SOC sees anything.
Adversaries use agentic AI and automation to stand up convincing infrastructure at scale:
- Typosquatted and lookalike domains that mirror your brand or your suppliers
- Fake executive or employee personas, complete with profile histories
- Deceptive social pages, app listings, and ecommerce storefronts
Attackers don’t have to guess what your environment looks like. Instead, they’re training on it by investing your public brand assets, your tone of voice, your design system, even your leadership’s public interviews, and then using that information to generate assets that feel right to your users and customers.
We saw this with an organization that suddenly found itself surrounded by fake support sites, bogus token drop pages, and impersonation profiles the moment it hit a certain profile. All of that lived outside the traditional perimeter, which meant their existing tools were effectively blind. The security team was stuck in a manual loop, discovering, validating, and reporting sites one by one while the attackers iterated faster than they could respond.
Stage 2: Launch
Once the infrastructure is in place, the campaign goes live.
This is where attackers turn their assets into outbound pressure, pushing weaponized content across multiple channels at once:
- Highly tailored phishing and vendor fraud emails
- Smishing via SMS, WhatsApp, and other messaging apps
- Vishing, powered by a deepfake voice, targets help desks and finance teams
- Fraudulent paid search and social ads that look indistinguishable from your own
This is targeted distribution, segmented by geography, language, role, even time of day—and attackers are using AI to continuously refine the lure based on what gets clicks.
In one recent campaign against a global productivity platform, attackers purchased paid search ads that displayed the legitimate URL and brand, but exploited ad platform redirect policies to deliver malicious binaries. To the victim, it looked like they’d clicked the real link. To a lot of legacy controls, it also looked benign, because the delivery wasn’t coming through the traditional perimeter at all.
Stage 3: Contact
Stage 3 is the quiet but critical pivot: Outside activity becomes inside presence.
This is where the lure actually lands in a trusted workspace:
- A spear‑phish surfaces in the primary inbox of a finance leader
- A fake MFA alert pops up as a text message on an employee’s phone
- A spoofed vendor message appears directly inside Teams or Slack
- A bogus recruiter connection hits a professional networking app
At this moment, the attack has crossed the line between internet noise and business context. It’s now sitting in the same place where your people approve invoices, change bank details, and reset credentials.
We’ve seen identity security teams document dozens of phishing attacks that never touched the mail gateway at all; they arrived via collaboration tools. And over 40% of modern campaigns now span multiple channels in a single sequence, meaning that if you only instrument email, you are effectively blind during a large portion of the contact phase.
Stage 4: Engagement
Engagement is where blocking ends and persuasion begins.
The static lure turns into a live, adaptive conversation:
- A “support agent” or “CFO” handles objections and builds pressure over chat or phone
- The attacker walks the victim through a spoofed login or MFA workflow in real time
- Synthetic voice clones persuade help desks to reset passwords or change MFA factors
- The back‑and‑forth stretches for minutes, not seconds, specifically designed to wear down skepticism
This is where AI has tilted the board. The attacker doesn’t need perfect English or stellar social engineering skills. They can lean on language models and voice models to carry the interaction, respond intelligently, and keep the victim engaged until the objective is met.
If all of your strategy is still centered on reducing click rates, you’re measuring the wrong thing.
By Stage 4, the real question is: How quickly can you detect and disrupt an active engagement before it becomes a business event?
Stage 5: Compromise
Stage 5 is where intent becomes impact.
Here, the attacker converts the engagement into something potentially material:
- Funds moved to attacker‑controlled accounts
- Sensitive data or IP exfiltrated from email and collaboration tools
- High‑privilege accounts are compromised and abused for lateral movement
- Ransomware deployed, operations disrupted, customers harmed
By the time you’re in full incident‑response mode, the attack chain has already done its work. Several upstream opportunities to intervene were missed, not because the team didn’t care, but because the tooling and mindset were optimized for isolated events, not end‑to‑end disruption.
Why “Blocking” Isn’t Enough
Most defenses today are still built for the latter portions of this chain.
We spend our time and money on:
- Inbound filters that try to keep bad messages out of inboxes
- Endpoint controls that look for malware execution
- Training programs that focus almost exclusively on don’t click this email
Those are table stakes. But they share the same limitations:
- They’re reactive: they wait for something to hit you
- They’re channel‑bound: what happens in email stays in email
- They’re infrastructure‑oblivious: they don’t dismantle the attacker’s ecosystem
A gateway might block a specific phishing email. It doesn’t:
- Remove the malicious domain from circulation
- Kill the fake app listing in an app store
- Take down the impersonation account that’s DM’ing your customers
- Disrupt the phone numbers and bots driving vishing and smishing campaigns
And when your partners or customers are scammed by those lookalikes, they don’t draw a neat line between “real you” and “fake you.” They blame your brand. They question your security. And those are scars that don’t heal just because you tuned a rule in your SEG.
If your strategy stops at “block the bad thing when it shows up,” you’re accepting that the attacker controls the tempo. You’re playing defense on their timeline, not yours.
The New Standard: Proactive, Unified Disruption
To actually disrupt social engineering in the AI era, security leaders have to move further left, into setup and launch phases, and treat the attacker’s infrastructure as part of the attack surface.
That’s the philosophy we’ve built into Doppel. Our platform was born in environments, crypto, and high‑visibility consumer brands, where social engineering doesn’t slow down for anyone, and where attackers can spin up ten new scams while you’re chasing one. From that experience, three requirements have become obvious.
1. Cross‑Channel AI Visibility
You can’t disrupt what you can’t see. And you can’t see a modern campaign if your tools only understand domains or email headers in isolation.
A modern platform has to:
- Use AI, natural language understanding, and computer vision to analyze content, not just infrastructure fields
- Continuously scan domains, social media, paid ads, app stores, and dark‑web sources in parallel
- Correlate signals: the same logo in a paid ad, a recently registered domain, a new impersonation handle, and an uptick in related phishing
When you connect those dots, you stop treating each alert like a mystery. You start seeing a coherent campaign you can act against as a whole.
2. Turning Email Evidence into Ammo via Honeypots
The way most organizations run phishing mailboxes today is a missed opportunity. Screenshots and partial forwards might help with awareness, but they rarely meet the evidentiary standards needed to force action from external providers.
To change that, you need automated honeypots that can safely engage with malicious senders. By doing that in a controlled, instrumented way, you can:
- Extract full header and routing information
- Map out the attacker’s sending infrastructure
- Package high‑confidence evidence that registrars, email providers, and platforms can’t ignore
Now, instead of quietly blocking a single attempt, you’re tearing down the attacker’s ability to send at all, from that account or domain, across your organization and beyond it.
3. API‑Driven, Automated Takedowns
Detection without fast remediation is just a slightly more detailed forensics report.
If your team has to open tickets, chase abuse inboxes, and haggle through legal for every takedown, you’re operating on human time. The adversary is operating on machine time. That’s not a fair fight.
A modern approach requires:
- Deep integrations and private APIs with registrars, social platforms, app stores, and telcos
- Policy‑driven playbooks that automatically trigger takedowns when thresholds are met
- A feedback loop so your SOC can see, in minutes, that the infrastructure has actually been removed
That’s the difference between “we saw a bad thing” and “we removed this adversary’s ability to keep running this campaign.”
From Blocking to Breaking the Chain
The attackers targeting your organization are running multi‑channel, AI‑accelerated operations. If you keep treating those operations as a collection of disconnected events, you’re going to keep getting surprised in the same places.
The shift we need as defenders is simple to say and hard to do:
- Move from blocking individual lures to disrupting entire campaigns
- Move from single‑channel tools to cross‑channel, infrastructure‑aware platforms
- Move from manual, ticket‑driven takedowns to automated, API‑level disruption
Resilience in this era won’t come from one more rule in your SEG or one more slide in your phishing training. It’ll come from treating the social engineering attack chain as something you can interrogate, map, and systematically break, before the attacker ever reaches your people, your customers, or your balance sheet.
Blocking is baseline. Disrupting is the goal.
About the author: Bobby Ford is the Chief Strategy and Experience Officer at Doppel, where he delivers strategic thought leadership on protecting brands, executives, and consumers from adaptive, AI-assisted social engineering threats. A globally recognized cybersecurity expert with nearly three decades of experience, Bobby spent 14 years as a CISO leading security programs for some of the world's most complex enterprises, including Hewlett Packard Enterprise, Unilever, and Abbott Labs. He began his career in the military as a founding member of the Pentagon Computer Incident Response Team.
Bobby Ford — Chief Strategy and Experience Officer at Doppel https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIoPAhtzIffL3B4mxEjl4IGaIkPPiaeRSBucARFM2pif4fcClALTnduktnxUFTFmcOHag0KSbGNsTm-0zREfO8MfSL4xOZOWWf26e8xnmByqYA9c209ZkfYTCvZHikRFRt9MSqXt-R30j5sBlYwNVyUdVBGSfr27nMnb-uia1_OiPNgaFTabVAmhEK4Ek/s1600/Bobby.png
