The Oppression of Politeness: Why Kindness is Enterprise Security’s Easiest Exploit

"Kids are social engineers."

In the very beginning of my second most popular course, I made this pretty bold claim. You caught me: part of it was because I simply wanted to gag the girls. I find that teaching is always more effective when you connect seemingly unrelated topics together. The modern workforce is filled with parents, and parents know kids best. Ears perk up because they instantly remember how Little Bobbie tricked them into ice cream before dinner by scribbling illegible nonsense all over his math homework. Little Bobbie may not know the plight of adulthood yet, but he sure knows when his parents are too tired to check his homework.

Parents know ball. That’s how some kids are.

Beyond being funny and relatable, there was intention in the concept: anyone is capable of using social engineering tactics to get what they want. It’s a very normal part of human behavior.

Social engineering is using the knowledge of human behavior to deceive and manipulate people.

This isn't to say that any old rando could be a professional social engineer. Getting out of a speeding ticket is vastly different from infiltrating a high-security building or talking bank staff out of sensitive financial records over the phone. But it uncloaks the "boogeyman," shows you the character behind the curtain. Social engineering isn't a dark art practiced exclusively by evil villains in underground lairs. It can be Sally, your coworker.

Think back: how many times have you watched a colleague deliberately bypass the ticketing system by sliding into an engineer's DMs to get their issue handled quicker? Manipulation. Even our very own help desks use psychological manipulation every day just to de-escalate an irate caller and get them off the phone. We just don't think of these everyday tactics as manipulation because nobody is losing a million dollars.

The Oppression of the 10/10 CSAT

Being polite, considerate, and empathetic is the heart of customer-facing roles, especially IT support. If I remember my time doing tech support clearly (and believe me, I do), your whole existence is measured by being a friendly problem solver. You strive to resolve the issue immediately, and you’re judged (often penalized) if a ticket persists past the first touch.

IT support folks are heavily incentivized via negative reinforcement to ensure users are happy, issues disappear quickly, and their resulting Customer Satisfaction (CSAT) score stays squarely above an 8 out of 10. Politeness is the implied culture of the help desk and the mechanism used to secure that 9 or 10 score.

And THAT is an attacker’s easiest exploit.

In current day breaches, adversaries aren't relying on malware and passive distribution anymore. Breaking you is easier than breaking in. When adversaries target an organization, they don't attack the firewall; they call the help desk. They know that behind that phone line or ticket queue is a human being who has been conditioned to eliminate friction at all costs.

Let’s illustrate this through Sol, our favorite security analyst, who today is wearing the IT Help Desk support hat:

Without Culturally Safe Friction: It’s 4:30 PM on a Friday. Sol gets an incoming call from a VP. He's furious, breathing heavy, and yelling about being locked out of an important presentation deck due to, what he calls, an "[eff]ed up, bull[spit] authentication app."

Sol knows the agreed-upon security policy: Every manual credential and MFA reset requires out-of-band verification via an employee's manager callback or video confirmation. But Sol also knows her manager hates getting escalations from executive leadership.

If Sol enforces the security rule, she risks an executive chewing her out, a formal complaint to her boss, and a 1-star CSAT review that impacts her quarterly performance. The fastest way to de-escalate the VP and keep her metrics in the green is to reset the access and send the VP on his not-so-merry way. And maybe go on her 15-minute break to chill out.

She gives him the access. Twenty minutes later, an external threat actor is inside the corporate network.

Now look at the alternative:

With Culturally Safe Friction: The exact same VP calls, bringing the exact same anger. But leadership has made it clear that support staff have 100% executive backing to enforce verification, no matter who is on the other end of the line.

Sol calmly tells the VP: "I understand this is urgent, and I want to get you access as soon as possible. Company policy requires me to complete an out-of-band verification before I can touch your MFA. Let's do that right now so I can safely get you in."

The VP might still be grumpy. He might even leave a petty 1-star CSAT review anyway. But Sol’s manager reviews the ticket, sees that Sol held the line, and praises her for following protocol. Everyone knows Sol isn't being unhelpful at all. She's just acting as an empowered steward of the established security policy.

Politeness Does Not Equal Acquiescence

We have to socialize the idea that good customer service does not mean total submission. Someone can be empathetic, calm, and professional while still telling an executive, "No, not until we verify your identity." I know, spooky stuff.

Friction is a completely normal part of working with human beings. There will be awkward confrontation, annoying but relevant procedural checks, and brief moments of discomfort. We’ve lost the plot by prioritizing frictionless customer service over security defense. If your support staff is terrified of getting a 1-star review from a stressed-out, sleep-deprived executive having a bad day, your security controls exist only on paper.

In my Social Engineering course, I highlighted a rule of thumb:

"You have to risk the awkwardness for the safety of the company."

If you want to plug the human vulnerabilities running rampant through your support channels, leaders need to take the burden of that awkwardness off the shoulders of frontline employees:

1. Normalize Out-of-Band Verification: Build strict, non-negotiable secondary verification workflows for any credential, MFA, or access reset, and ensure there are zero VIP workarounds. If the CEO calls, the CEO gets verified out-of-band. Period.
2. Train for Emotional Spikes: Teach frontline staff to spot the feeling of artificial urgency, anger, and panic. When a caller brings intense pressure, that emotional spike isn't a cue to move faster. Like I say in my course, it’s an immediate signal to slow down and verify.
3. Control the CSAT, Don't Let it Control You: Protect your team from retaliatory CSAT scores. If an analyst followed protocol and an impatient caller gave them a negative review out of spite, leadership should throw that review in the trash and commend the analyst for doing their job.

You can't patch human empathy with a software update, but you can build a culture where being cautious doesn't result in a career hit.

(If you want to learn more, check out my course, Cybersecurity Awareness: Social Engineering, on LinkedIn Learning.)