Uploaded February 2026 | Updated September 2026, 2 weeks ago
Ethics on the Line Balancing Social Engineering Success with Target Protection
Presenter: Jennifer Isacoff
Why do social engineering assessments raise ethical concerns?
Social engineering engagements like phishing and vishing are powerful tools for exposing weaknesses in an organization’s defenses. They work by exploiting human trust. But what happens to the people who fall for them after the test is over?
What is this talk about?
This 15 minute campfire talk explores the ethical challenges of selling and conducting social engineering assessments without causing unintended harm to employees. Even when reports anonymize identities, basic security logs can often reveal who failed, sometimes leading to blame or punishment long after the engagement ends.
Why is this a problem for practitioners?
This creates a difficult question for social engineering professionals. How do you clearly demonstrate risk to a client while protecting the individuals being tested? The tension between accountability and education can undermine trust in both the assessment and the security team.
What ethical questions are discussed?
The session sparks an open discussion around whether mandatory post engagement training is the only ethical path forward, or if engagements can be designed to preserve anonymity while still delivering meaningful value to clients.
What real world experiences inform this talk?
Drawing from real world social engineering engagements, the discussion explores situations where proving impact, such as initial access or credential capture, conflicted with safeguarding individuals from negative consequences.
What solutions are on the table?
Expect a lively debate around practical approaches including creative contract language, log obfuscation strategies, client education, and engagement design choices that prioritize learning over punishment.
Who should attend?
This talk is for social engineering professionals, red teamers, defenders, and newcomers interested in the human side of security testing.
What is the goal of this session?
This is not just about ethics. It is about sustaining trust in the craft of social engineering while responsibly addressing the human factor that makes these attacks so effective.
Bring your stories, ideas, and opinions and let’s hash it out around the campfire.
Sign Up for WWHF
Register for this year’s Wild West Hackin Fest here:
wildwesthackinfest.com/register
Get access to workshops, labs, and sessions taught by experienced practitioners, all focused on real world defensive and investigative skills.
#cybersecurity #socialengineering #phishing #vishing #infosec #redteam #securityethics #humanfactor #defensivesecurity #cyberawareness
///Black Hills Infosec Socials
Twitter: twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: linkedin.com/company/antisyphon-training
Discord: discord.gg/ffzdt3WUDe
///Black Hills Infosec Shirts & Hoodies
spearphish-general-store.myshopify.com/collections/bhis-shirt-collections
///Black Hills Infosec Services
Active SOC: blackhillsinfosec.com/services/active-soc
Penetration Testing: blackhillsinfosec.com/services
Incident Response: blackhillsinfosec.com/services/incident-response
///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: backdoorsandbreaches.com
Play B&B Online: play.backdoorsandbreaches.com
///Antisyphon Training
Pay What You Can: antisyphontraining.com/pay-what-you-can
Live Training: antisyphontraining.com/course-catalog
On Demand Training: antisyphontraining.com/on-demand-course-catalog
Antisyphon Discord: discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training
///Educational Infosec Content
Black Hills Infosec Blogs: blackhillsinfosec.com/blog
Wild West Hackin' Fest YouTube: youtube.com/wildwesthackinfest
Antisyphon Training YouTube: youtube.com/antisyphontraining
Active Countermeasures YouTube: youtube.com/activecountermeasures
Threat Hunter Community Discord: discord.gg/threathunter
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com
Ethics on the Line Balancing Social Engineering Success with Target Protection
Presenter: Jennifer Isacoff
Why do social engineering assessments raise ethical concerns?
Social engineering engagements like phishing and vishing are powerful tools for exposing weaknesses in an organization’s defenses. They work by exploiting human trust. But what happens to the people who fall for them after the test is over?
What is this talk about?
This 15 minute campfire talk explores the ethical challenges of selling and conducting social engineering assessments without causing unintended harm to employees. Even when reports anonymize identities, basic security logs can often reveal who failed, sometimes leading to blame or punishment long after the engagement ends.
Why is this a problem for practitioners?
This creates a difficult question for social engineering professionals. How do you clearly demonstrate risk to a client while protecting the individuals being tested? The tension between accountability and education can undermine trust in both the assessment and the security team.
What ethical questions are discussed?
The session sparks an open discussion around whether mandatory post engagement training is the only ethical path forward, or if engagements can be designed to preserve anonymity while still delivering meaningful value to clients.
What real world experiences inform this talk?
Drawing from real world social engineering engagements, the discussion explores situations where proving impact, such as initial access or credential capture, conflicted with safeguarding individuals from negative consequences.
What solutions are on the table?
Expect a lively debate around practical approaches including creative contract language, log obfuscation strategies, client education, and engagement design choices that prioritize learning over punishment.
Who should attend?
This talk is for social engineering professionals, red teamers, defenders, and newcomers interested in the human side of security testing.
What is the goal of this session?
This is not just about ethics. It is about sustaining trust in the craft of social engineering while responsibly addressing the human factor that makes these attacks so effective.
Bring your stories, ideas, and opinions and let’s hash it out around the campfire.
Sign Up for WWHF
Register for this year’s Wild West Hackin Fest here:
wildwesthackinfest.com/register
Get access to workshops, labs, and sessions taught by experienced practitioners, all focused on real world defensive and investigative skills.
#cybersecurity #socialengineering #phishing #vishing #infosec #redteam #securityethics #humanfactor #defensivesecurity #cyberawareness
///Black Hills Infosec Socials
Twitter: twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: linkedin.com/company/antisyphon-training
Discord: discord.gg/ffzdt3WUDe
///Black Hills Infosec Shirts & Hoodies
spearphish-general-store.myshopify.com/collections/bhis-shirt-collections
///Black Hills Infosec Services
Active SOC: blackhillsinfosec.com/services/active-soc
Penetration Testing: blackhillsinfosec.com/services
Incident Response: blackhillsinfosec.com/services/incident-response
///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: backdoorsandbreaches.com
Play B&B Online: play.backdoorsandbreaches.com
///Antisyphon Training
Pay What You Can: antisyphontraining.com/pay-what-you-can
Live Training: antisyphontraining.com/course-catalog
On Demand Training: antisyphontraining.com/on-demand-course-catalog
Antisyphon Discord: discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training
///Educational Infosec Content
Black Hills Infosec Blogs: blackhillsinfosec.com/blog
Wild West Hackin' Fest YouTube: youtube.com/wildwesthackinfest
Antisyphon Training YouTube: youtube.com/antisyphontraining
Active Countermeasures YouTube: youtube.com/activecountermeasures
Threat Hunter Community Discord: discord.gg/threathunter
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com
