SEF
Social Engineering Framework
A systematic methodology for assessing organizational resilience against social engineering attacks through structured threat modeling, quantitative scoring, and evidence-based remediation.
The Gap Model
Social engineering exploits the gap between security policy and human behavior. This gap exists in every organization and represents the attack surface that adversaries target.
Knowledge Gap
Difference between what employees should know and what they actually know about security
Behavior Gap
Difference between what employees know and what they actually do
Culture Gap
Difference between stated security values and actual organizational culture
Process Gap
Difference between designed security processes and actual workflows
Framework Phases
Seven structured phases from initial threat modeling through remediation and continuous improvement.
Select a phase above to explore activities and deliverables
SESA Scoring System
Social Engineering Susceptibility Assessment (SESA) provides quantitative measurement across six key dimensions of organizational resilience.
Significant vulnerabilities exist. Immediate focus needed on awareness training and process formalization.
Security Awareness
Organizational understanding of social engineering threats and recognition capabilities
Process Maturity
Formalization and enforcement of security procedures across the organization
Security Culture
Integration of security mindset into organizational values and daily operations
Technical Controls
Technology-based defenses that reduce social engineering attack surface
Incident Response
Capability to detect, respond to, and recover from social engineering attacks
Organizational Resilience
Ability to maintain operations and recover from successful social engineering attacks
Dimension Breakdown
Technique Taxonomy
MITRE-aligned categorization of social engineering techniques with psychological levers, indicators, and mitigations.
Select a category above to explore techniques
Psychological Levers
Understanding the cognitive biases and psychological principles that social engineers exploit.
Authority
Tendency to comply with perceived authority figures
Impersonating executives, law enforcement, IT administrators
Verification procedures, out-of-band confirmation
Urgency
Reduced critical thinking under time pressure
Creating artificial deadlines, crisis scenarios
Pause procedures, escalation protocols
Trust
Reliance on established relationships and familiarity
Impersonating known contacts, exploiting vendor relationships
Verification for sensitive requests, trust but verify culture
Fear
Compliance driven by threat of negative consequences
Account suspension threats, job threats, legal threats
Reporting culture, escalation without fear
Helpfulness
Natural inclination to assist others
Requesting assistance with seemingly innocent tasks
Security awareness about helping strangers
Reciprocity
Obligation to return favors
Providing small gifts or help before making requests
Awareness of reciprocity manipulation
Social Proof
Following the actions of others
"Everyone else does this", "Your colleagues approved"
Independent verification, question group actions
Scarcity
Increased value perception of limited availability
Limited time offers, exclusive access
Pause before acting on scarcity claims
Threat Actor Tiers
Understanding adversary capabilities helps calibrate defensive investments and assessment rigor.
Opportunistic
Low-sophistication actors using widely available tools and techniques
Organized Criminal
Professional criminal organizations with dedicated SE capabilities
Advanced Persistent
Sophisticated actors with long-term objectives and significant resources
Nation-State
State-sponsored actors with unlimited resources and strategic objectives
Operational Modes
SEF supports two distinct operational modes based on organizational objectives and risk tolerance.
Assessment Mode
Low RiskControlled testing to measure susceptibility without causing harm
Scope
- • Phishing simulations
- • Vishing assessments
- • Physical access testing
- • OSINT analysis
Deliverables
- → SESA score
- → Gap analysis report
- → Remediation roadmap
- → Training recommendations
Operations Mode
High RiskFull-scope red team operations simulating real adversary behavior
Scope
- • Multi-vector campaigns
- • Physical intrusion
- • Objective achievement
- • Persistence testing
Deliverables
- → Attack narrative
- → Compromise evidence
- → Detection gap analysis
- → Control effectiveness report
Human Layer Threat Modeling (HLTM)
HLTM is the foundation of SEF, providing systematic identification of human-centric attack surfaces before assessment begins.
Asset Identification
Mapping personnel with access to critical systems, data, or decisions
Threat Mapping
Identifying likely adversaries and their human-targeting capabilities
Vulnerability Analysis
Assessing organizational susceptibility to social engineering
Attack Path Modeling
Designing likely attack chains targeting human vulnerabilities
Adversarial Minds
The Psychology of Social Engineering
A comprehensive exploration of social engineering psychology, techniques, and defenses. This book provides the theoretical foundation for the SEF methodology.
Download the Complete SEF (PDF)
Get the full tactical blueprint including threat matrices, SESA worksheets, assessment checklists, and implementation guides.
- Complete SESA scoring worksheets
- Technique taxonomy with mitigations
- Phase-by-phase implementation guide
- Threat actor response matrix
About the Author
Kai Aizen is a GenAI Security Researcher specializing in adversarial AI, social engineering, and human-layer security. He is the creator of the AATMF and SEF frameworks and author of Adversarial Minds.