Core Principle

Social engineering is fundamentally about creating a false sense of legitimacy or trust. Attackers exploit authority, familiarity, urgency, impersonation, and weaknesses in verification processes to make an illegitimate request, identity, or action appear acceptable. Across many social engineering techniques, the attacker’s objective is to have trust or authority assumed without it being adequately verified.

Pretext8 rests on a single defensive belief.

Core principle

Legitimacy is established, not assumed.

The right to take a sensitive action is confirmed through independent verification and never inferred from how convincing, familiar, authoritative, or routine the request appears.

What this means

Much of human-layer compromise occurs when legitimacy is assumed rather than properly established. People often rely on cues such as confidence, familiarity, urgency, appearance, or an existing relationship when deciding whether something is trustworthy. A caller may sound credible, an email may look familiar, or a supplier may have been trusted many times before, and those factors can be enough for a request to be accepted without further verification. The weakness arises when contextual cues are treated as proof, allowing an attacker to exploit the gap between something appearing legitimate and actually being legitimate.

The principle inverts that default. Legitimacy should be confirmed before a sensitive action is allowed to proceed, rather than assumed simply because a person, request, or situation appears credible. This holds whether the pressure is psychological or absent entirely:

• Where an attacker applies pressure through authority, urgency, fear, or scarcity, the principle reduces its effectiveness by requiring verification regardless of the pressure being applied.
• Where an attacker applies no pressure at all and instead relies on helpfulness, curiosity, routine, or a permissive process, the principle still applies. An ordinary request or familiar process should not be treated as legitimate without appropriate verification.

Crucially, the principle attaches to the action, not the actor. Verifying who someone is no longer guarantees that what they are asking for is legitimate. A genuine account may be compromised, and even authentic identity information can be manipulated or reproduced. Sensitive actions should therefore be verified in their own right, regardless of how trustworthy the source appears.

How it threads through the Pretext8 framework

This principle is carried through the Pretext8 control domains, which establish legitimacy across identity, actions, processes, physical access and trusted relationships. See SECA for more information.

Scope and limits

This principle focuses on deception-based social engineering activity, where an attacker creates the appearance of legitimacy to make a request, identity, or action seem genuine.

Where the principle does not reach

• Insider abuse. Where a legitimately authorised person misuses access they genuinely hold, their legitimacy is real, not assumed. This sits outside the principle and is addressed through the insider threat overlap, monitoring, and least-privilege controls rather than verification at the point of request.
• Coercion. Where a target knows a request is illegitimate but complies under threat, establishing legitimacy is not the failure point. This is extortion rather than manipulation and is handled through duress, reporting, and welfare pathways.
• Slow relational compromise. A long-running confidence or romance scam assumes legitimacy gradually, across many innocuous interactions, with no single moment that presents itself as a verification decision. Point-in-time verification cannot catch it; defence here depends on pattern recognition over time rather than a single establishing step.