Definition
Pretexting is a social engineering tactic where an attacker fabricates a scenario or identity to manipulate a victim into divulging sensitive information or performing an action they otherwise wouldn't. The attacker creates a believable pretext, such as posing as IT support or a trusted colleague, to gain the victim's confidence and bypass security protocols. This technique is effective because it exploits human trust and a desire to be helpful, making it a significant threat to organizational security. For instance, an attacker might call an employee claiming to be from HR and requesting personal details to 'update their records.' Pretexting differs from phishing in that it often involves direct, personalized interaction rather than mass unsolicited messages. Understanding pretexting is crucial for security professionals and is covered in certifications like CompTIA Security+ and CISSP.