A recent Dark Reading piece makes a point that anyone who has run a red team engagement already knows instinctively: Sherlock Holmes was practicing social engineering more than a century before Kevin Mitnick picked up a phone. Disguises, surveillance, informant networks, pretexting — Arthur Conan Doyle's detective used every technique in the modern social engineer's playbook, and he used them against targets who never saw it coming because the attack surface was human trust, not technology.
This matters in 2026 because nothing has changed except the delivery mechanism. Industry breach data continues to confirm that the human element is involved in the majority of successful intrusions — whether that's a phishing click, a help-desk password reset performed on a convincing pretext, or an executive assistant manipulated into wiring funds. Threat actors from Scattered Spider to state-sponsored initial access brokers lead with social engineering because it bypasses your EDR, your SIEM, and your zero-trust architecture by simply asking a person to open the door. If your defensive program treats social engineering as an annual training checkbox, you are defending against the attacker you wish you had, not the one you actually face.
Technical Analysis: The Holmes Playbook, Mapped to Modern TTPs
The Dark Reading analysis breaks Holmes's methods into categories that map almost one-to-one onto MITRE ATT&CK techniques we see in live intrusions today. Let's walk through them from a defender's perspective.
Disguise and Impersonation → Pretexting (ATT&CK T1656)
Holmes famously adopted disguises — a groom, an old woman, a clergyman — to gain physical proximity and trust. The modern equivalent is impersonation of IT support, executives, vendors, or recruiters. Groups like Scattered Spider (UNC3944) built their entire initial access model on calling help desks with a convincing pretext, often armed with employee PII harvested from data broker sites and prior breaches, and walking away with reset MFA tokens and fresh credentials. The 2023–2025 wave of intrusions against SaaS and telecom targets demonstrated that a fifteen-minute phone call is more reliable than any zero-day.
Defender's note: The disguise works because the target has no verification procedure, not because the disguise is flawless. Holmes's victims could have unmasked him by asking one question only the real person would know. Your help desk can do the same with mandatory identity-proofing workflows.
Surveillance and Observation → Reconnaissance (ATT&CK T1593, T1589)
Holmes watched his targets, noted their habits, and built a picture before acting. Modern adversaries do this at scale: LinkedIn scraping for org charts, job postings that reveal technology stacks, corporate social media that exposes travel schedules and executive names, and breach corpora that reveal password patterns. Open-source intelligence (OSINT) gathering is now largely automated — an attacker can profile your finance team's reporting structure and your CFO's writing style in an afternoon, which is precisely why business email compromise (BEC) pretexts feel so credible.
Defender's note: Assume everything publicly visible about your organization will be weaponized. Your exposure is measurable and should be treated like attack surface, because it is.
The Irregulars → Intelligence Networks and Insider Access
Holmes maintained the Baker Street Irregulars — a network of informants with access he lacked. Attackers do the same: recruiting insiders, purchasing access from initial access brokers, bribing telecom or SaaS support employees, and infiltrating contractor ecosystems. The supply-chain and help-desk intrusion campaigns of the past two years repeatedly featured a human on the inside, willing or unwitting, who collapsed the trust boundary.
Reading the Mark → Psychological Manipulation
Holmes's real gift wasn't disguise; it was reading people — knowing which pressure to apply. Modern social engineers exploit the same levers Cialdini catalogued: authority ("this is the CISO's office"), urgency ("the wire must go out before close of business"), scarcity, and reciprocity. AI-generated voice and video have industrialized this lever in 2025–2026: vishing calls with cloned executive voices and deepfake video conferences have already produced eight-figure fraud losses at multinational firms. The pretext no longer needs to survive scrutiny in writing — it arrives speaking in your CEO's voice.
Exploitation Status
This is not a theoretical risk. Social engineering is the confirmed initial vector in the majority of high-profile intrusions reported over the past 24 months, including help-desk takeover campaigns against major enterprises, MFA fatigue and push-bombing attacks, voice-clone fraud, and MFA-bypass phishing kits (adversary-in-the-middle frameworks such as Evilginx-class tooling) that defeat token-based MFA in real time. There is no patch forthcoming. The only remediation is architectural and procedural.
Executive Takeaways
Because this threat is procedural and human rather than a patchable software defect, the highest-value controls are organizational. These are the recommendations we give every client after social-engineering-driven IR engagements:
1. Harden the help desk like it's a production firewall — because attackers treat it as one. Mandate identity verification for any credential reset, MFA change, or device enrollment: require a manager callback on a known number, an in-person or video confirmation for privileged accounts, or integration with an identity-proofing service. Log and alert on every MFA reset and new device registration, and treat resets followed immediately by impossible-travel logins as a high-severity incident. This single control would have stopped the majority of the Scattered Spider-style intrusions of the past two years.
2. Deploy phishing-resistant MFA and phase out everything phishable. SMS, TOTP apps, and push notifications all fall to adversary-in-the-middle phishing kits and push fatigue. FIDO2/WebAuthn hardware keys or platform passkeys cryptographically bind authentication to the legitimate origin and are the only MFA classes that hold up under AiTM attack. Prioritize coverage for help-desk staff, administrators, finance, and executives — the roles attackers pretext against first.
3. Build verification culture for out-of-band requests, and drill it. Every wire transfer, credential change, or sensitive data request initiated by email, chat, or voice must require verification through a second, independently initiated channel — a callback to a number in the directory, not the number in the email signature. With voice cloning now commodity, "I recognized his voice" is no longer verification. Run tabletop exercises and live pretexting simulations against finance and executive assistants specifically; generic phishing simulations don't exercise these pathways.
4. Measure and reduce your OSINT exposure. Commission a periodic assessment of what an attacker can learn about your org from public sources: employee directories, job postings that name security tooling, executive social media, data broker listings, and breached credential corpora. Establish takedown and data-broker opt-out processes for key personnel, and brief executives' families and assistants — they are frequently the softest reconnaissance target.
5. Detect the post-social-engineering phase, because some pretexts will succeed. Assume breach. The behaviors that follow a successful social-engineering intrusion are observable: new MFA device registrations, inbox forwarding rules, OAuth consent grants to unfamiliar applications, help-desk reset followed by anomalous login geography, and enumeration of identity stores (Azure AD/Entra ID, Okta) from user-context sessions. These are high-fidelity, low-noise detections that belong in every SOC's analytics library. Pair them with a 24/7 hunting capability — either in-house or through a managed detection partner — because these intrusions move from initial access to data theft in hours, not weeks.
6. Extend the perimeter of awareness training beyond employees. Holmes succeeded because everyone around the target — landladies, cab drivers, clerks — was an unwitting sensor for the adversary. Your equivalents are contractors, vendors with VPN or SaaS access, and third-party support organizations. Contractually require MFA standards and social-engineering training for third parties with access, and include vendor compromise scenarios in your IR playbooks.
Remediation
There is no vendor advisory to apply here — the vulnerability is procedural trust. Remediation is a program, not a patch:
- Within 30 days: Implement help-desk identity verification for credential/MFA resets; enable alerting on MFA device changes and inbox forwarding rule creation; audit OAuth application consents across your tenant.
- Within 90 days: Begin FIDO2/passkey rollout for privileged users, help-desk staff, and finance; establish out-of-band verification policy for financial transactions; run a targeted vishing/pretexting simulation.
- Within 180 days: Complete phishing-resistant MFA coverage for all users; conduct an OSINT exposure assessment; integrate third-party security requirements into vendor contracts; validate that your SOC (internal or managed) has analytics covering the post-compromise behaviors listed above.
The lesson Holmes leaves us isn't charming — it's uncomfortable. The most effective attackers have never needed to break your encryption or exploit your kernel. They walk in through the front door, wearing a disguise your processes never thought to check. Close that door with procedure, phishing-resistant authentication, and detection depth, and you force the adversary back onto the attack surfaces where your technology investments actually work.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.