A pretext is a fabricated story used to make a request seem legitimate. In cyber security, it is a common social engineering tool: the attacker invents a believable reason to ask for credentials, a password reset, access approval, or sensitive information. The story may sound routine, such as an HR update, an urgent support issue, or a manager’s request, because familiarity lowers suspicion.
Pretexts matter because many security failures happen at the trust boundary, before technical controls are involved. A convincing pretext can pressure staff into skipping verification or following an unusual process. Defenders reduce this risk with training, clear approval workflows, identity checks, and escalation steps for unusual requests. Automated review can also help by flagging requests that do not match normal patterns, giving humans a chance to verify the story before trust is granted.