Getting People to Do What You Want Without Them Realizing It
I spent about four years running social engineering assessments for mid-size banks and healthcare providers. The most consistent pattern I saw wasn't technical weakness. It was human psychology being predictable to a degree that almost frustrates me every single time. People have been studied, categorized, and codified into what people call The Law Of Influence. It's not a single theorem. It's a collection of observation-based principles about how humans respond to requests, authority, scarcity, and reciprocity. The core framework comes from Robert Cialdini's work, but anyone who actually does this work knows the textbook version is incomplete. There are edge cases where the six principles fail predictably. I'll get to that.
The Law Of Influence in practice
The six recognized principles are reciprocity, commitment and consistency, social proof, authority, liking, and scarcity. Each one operates on a different psychological trigger. Reciprocity is the simplest. If you give someone something first, they feel obligated to return the favor. This isn't theoretical. In a typical engagement, a pre-text caller offering a small courtesy like holding a door or bringing coffee gets cooperation rates in the 60 to 70 percent range for follow-on requests that would normally be denied. Commitment and consistency works differently. Once someone says yes to a small request, they are significantly more likely to say yes to a larger one later because people want their behavior to align with their stated identity. This is why social engineers often start with low-stakes questions before asking for credentials. The person has already established a pattern of cooperation. Social proof is the crowd effect. If someone believes other people are doing something, they assume it is acceptable or correct. This is especially potent in ambiguous situations where the person has no clear procedure to reference. Authority triggers compliance through perceived hierarchy. A uniform, a badge, a title, even a well-tailored suit can shift response rates dramatically. Liking operates on the principle that we say yes more often to people we find agreeable. Scarcity creates urgency through limited availability.
Here is where beginners go wrong. They apply these principles like recipes. They are not recipes. Context matters enormously. I once had a case where a client's employees responded negatively to overt displays of authority. They worked in a regulated nuclear facility where aggressive authority figures were associated with past trauma from poor management practices. When I used a soft approach instead, relying on reciprocity and shared context, compliance jumped from under 20 percent to over 55 percent in the same assessment window.
Get the Full Details
Why This Matters For Security Teams
If you are reading this as a security professional, you need to understand that The Law Of Influence is not just an attack tool. It is also your primary defense framework. Most breach investigations show that human manipulation preceded the technical compromise. Phishing emails use urgency and authority. Phone-based vishing attacks leverage reciprocity and liking. Tailgating exploits social proof and politeness norms. The practical application starts with training. But not the generic compliance training that everyone sleeps through. Effective programs simulate actual influence attempts. Employees should experience reciprocity-based requests, fake authority escalations, and scarcity-driven pressure in controlled scenarios. The results should be tracked. I have seen organizations cut successful pre-texting rates from 40 percent down to under 8 percent over six months by running monthly simulated attacks with immediate feedback sessions. There is a specific problem that comes up regularly and most people do not account for it. When you train employees using only one type of influence principle, they become selectively resistant. I ran assessments for a hospital system where staff had been trained intensively on phishing awareness. They spotted email-based authority plays at an 89 percent rate. But they were nearly helpless against a phone-based scenario that combined reciprocity with a legitimate-sounding IT reset request. The attacker offered to help them resolve a minor inconvenience they were already experiencing. Compliance hit 61 percent. The fix was diversified simulation across multiple channels and principle combinations, which brought overall resistance up to about 72 percent across all vectors.
Advanced Nuances Most Guides Skip
Most sources present the six principles as independent. They are not. They compound. When two or more principles operate simultaneously, the effect is multiplicative, not additive. An email that combines authority with urgency and social proof does not produce three units of influence. It produces roughly six. This is why advanced threat actors layer these so carefully. Another thing beginners miss is the concept of influence fatigue. People can resist manipulation for short periods. After sustained exposure, their resistance degrades. This is why prolonged operations, like an attacker maintaining contact over days or weeks through a constructed relationship, often succeed where quick hits fail. The gradual escalation allows the target to adjust their baseline of normal interaction without triggering alarm. There is also the principle of opposition, which Cialdini addressed but rarely gets enough attention. When people feel their freedom is being threatened by an overt influence attempt, they react against it. This is called psychological reactance. The more pushy the approach, the stronger the rejection. I have seen experienced social engineers take a step back and reduce pressure when they sensed reactance building. Lowering the intensity by even 30 percent can flip a declining response back toward cooperation.
The biggest limitation of The Law Of Influence as a framework is that it does not account for cultural variation. What works in a low-context American business environment may fail completely in a high-context East Asian setting where indirect communication and relational hierarchy dominate. I learned this the hard way during an assessment in Tokyo. The reciprocity-based approach that worked flawlessly in Chicago produced near-zero compliance in Osaka. Switching to a respect-based authority frame aligned with local business etiquette brought rates back to expected levels. Cultural literacy is not optional if you are operating internationally.
Practical Implementation Steps
If you want to build a program around understanding and countering influence attacks, start with a baseline assessment. Run simulated attacks using each of the six principles across your most vulnerable departments. Document response rates by principle, by department, and by seniority level. This data tells you where your weaknesses are before attackers do. Next, build layered training. Do not rely on annual compliance modules. Run quarterly simulations with immediate debriefs. Use the actual simulation results to tailor content. If your finance team consistently falls for authority-based vishing but your engineering team does not, your training should reflect that difference rather than treating everyone identically. Include the principle of opposition in your training. Teach people that feeling pressured is not a normal or acceptable response to routine requests. Give them scripted deflection language. Phrases like I need to verify this through our standard process or I will call you back at the official number create institutional friction that breaks influence chains.
Finally, measure continuously. The compliance landscape shifts. New tactics emerge. Attackers study the same frameworks you do. A program that worked well two years ago may already be outdated. Track your metrics quarterly and adjust accordingly. The Law Of Influence is not a magic system. It is an observation of human behavior under specific conditions. It works reliably when applied correctly, but it fails in the right conditions. Understanding both its power and its limits is what separates professionals from people who treat social engineering like a party trick.
