> Is it really social engineering if the employees followed the Microsoft policy I'd say that the attack vector is still social engineering; the difference her

> Is it really social engineering if the employees followed the Microsoft policy I'd say that the attack vector is still social engineering; the difference here is that the result is not based in policy failure. Normally we recommend that clients require their employees to attend security awareness training, in order for them to understand social engineering risks and remind them to follow the correct policies that are put in place. In this instance, however, there is no policy being broken. My summation of the issue would be that it is a policy failure being exploited by a social engineering attack vector.