When people talk about hackers, the image that almost everyone has in their head comes straight from the movies. It's always the same scene: a young person in a hoodie, shut away in a dark room, surrounded by screens full of green text scrolling at high speed, typing furiously until, in a moment of dramatic tension, they manage to break into the most protected system on the planet. Often all it takes is an "I'm in" said with a triumphant look, and just like that, the digital vault has been cracked open.
The reality, as one might expect, is far less cinematic. After a few semesters studying Computer Engineering and reading about the subject out of personal curiosity, one quickly realizes that most cyberattacks have nothing spectacular about them. There's no superhuman technical genius, no systems breached in seconds through mysterious commands. Often what actually exists is a simple email, a well-written message, or a convincing phone call. And this is exactly where the central idea of this text lies: nowadays, it is frequently easier to trick a person than to overcome the technical defenses of a computer system.
This doesn't mean technology has stopped mattering - far from it. It simply means that, as systems become more robust, attackers have gradually shifted their focus toward something that remains unpredictable and, in many cases, more vulnerable: human behavior.
Hacker vs. Cracker: A Confusion Worth Clearing Up
Before going further, it's worth clearing up a common misunderstanding, especially since it was something that confused me too when I first became interested in the field. The term "hacker" doesn't, by definition, mean someone who commits computer crimes. In its origin, a hacker is simply a curious person, someone who enjoys understanding how things work on the inside, who likes exploring systems, testing limits, and finding creative solutions to complex problems. Many security researchers, programmers, and even professionals who work to protect companies describe themselves as hackers, precisely because that curiosity is what drives them to understand flaws in order to later fix them.
Whoever uses that technical knowledge with malicious intent actually has a name of their own: cracker. It's the cracker who steals data, sabotages systems, encrypts files to demand ransoms, or breaks into other people's accounts with the aim of causing harm or gaining illegitimate profit. The difference lies not so much in technical skill, which can be similar, but in the intent and ethics behind the action. Unfortunately, the popular use of the term "hacker" ended up absorbing this negative meaning, which is why the distinction has almost been lost in everyday language, even though it remains relevant for anyone studying or working in the field.
Why Technology Is No Longer the Main Problem
In recent years, computer security systems have evolved considerably. Today there are mechanisms that make a purely technical attack considerably harder to pull off. Multi-factor authentication, for example, is one of those barriers: instead of a password alone being enough to access an account, a second confirmation element is also required, such as a code sent to a phone or a notification in a dedicated app. Even if someone discovers another person's password, they will hardly also have access to that second factor.
Encryption is another relevant example. Put simply, encrypting information means transforming it in such a way that, even if someone manages to access that data without authorization, they can't read or use it without possessing the correct "key" to decode it. It's like storing a message inside a safe whose combination only the recipient knows. In addition, there are intrusion detection systems, which function like sensors within computer networks, capable of identifying strange behavior and alerting those responsible before an attack succeeds. On top of all this, companies now have increasingly strict security policies, which set clear rules for how data should be handled and protected.
With so many layers of protection, one might expect cyberattacks to become increasingly rare. And yet, they keep happening, quite frequently. The reason is simple to state, though complex to solve: no matter how sophisticated the technology, it always depends on people to use it correctly. And people get tired, get distracted, trust too quickly, or simply aren't aware of certain risks. A system can have the best defenses in the world, but if an employee shares their password by mistake or clicks on a suspicious link without thinking twice, all that investment in security loses much of its value.
Social Engineering: The Real Target
It's precisely in that space, between technology and the user, that what is called social engineering comes into play. It is, at its core, a set of psychological manipulation techniques used to convince a person to do something they normally wouldn't, such as revealing a password, transferring money, opening a dangerous file, or providing personal data. What sets these attacks apart is that they don't exploit flaws in code or vulnerabilities in programs - they exploit human flaws, like trust, haste, or fear.
The best-known example is undoubtedly phishing. Simply put, it consists of sending messages or emails that pretend to come from a credible entity, such as a bank, a courier company, or even the victim's own workplace, with the goal of getting them to click on a fake link or enter sensitive data into a fraudulent form. These messages are often crafted quite carefully, replicating logos, colors, and even the usual writing style of the entity being impersonated, which makes telling the real from the fake far harder than one might initially think.
A very common case is fake bank messages, which warn of supposedly suspicious activity on an account and ask the victim to confirm their login details through a link. Another frequent example is emails that appear to come from the victim's own employer, sometimes even signed in the name of a superior, urgently requesting a bank transfer or the sending of confidential information. There are also the well-known fake offers or prizes, which promise the victim they've won a raffle or a free product, requiring only that they fill in a short form with their personal or banking details.
What all these examples have in common is how they play on human emotions. Curiosity can lead someone to open a suspicious attachment just to find out what it is. Trust makes it easy to believe a message that appears to come from a familiar source. Fear, in turn, is perhaps the most effective weapon: messages warning of a supposed account suspension, an overdue debt, or an imminent legal problem create a sense of urgency that stops the victim from thinking calmly before acting. Distraction also plays its part, especially when these messages arrive at busier moments, such as during work hours, when there's less time to examine everything carefully. Finally, time pressure, often artificially created through phrases like "respond within the next two hours or your account will be suspended," pushes people to act on impulse rather than reflect.
Real Cases: When the Human Factor Decides Everything
The theory carries more weight when looking at concrete cases that have actually happened. One of the most cited examples in cybersecurity is the attack on the American retail chain Target, which occurred in 2013. In that case, the attackers didn't try to directly breach the company's systems. Instead, they managed to gain access to the credentials of a partner company responsible for maintaining air conditioning systems, through a phishing email sent to one of its employees. From those credentials, compromised through human error rather than a direct technical flaw, the attackers managed to reach Target's network and ended up compromising the payment data of tens of millions of customers. The point of entry wasn't a poorly protected system - it was a person who trusted a message they shouldn't have.
Another common type of situation, widely discussed in cybersecurity reports, involves ransomware attacks that begin with a simple phishing email sent to a company employee. The employee receives an apparently harmless message, perhaps disguised as an invoice, a résumé, or an urgent document, and upon opening the attachment ends up unknowingly triggering a process that encrypts the entire organization's files. Only afterward is a ransom demanded for the data to become accessible again. This type of attack has been responsible for paralyzing hospitals, schools, and companies in several countries, and in most documented cases, it all began with a single person clicking where they shouldn't have.
What these examples show, more than any theoretical explanation could, is that technical systems can be well protected and still be circumvented through a simple human deception. There was no need to break any encryption or bypass sophisticated firewalls. A well-written message and a distracted or hurried person were enough.
Final Reflection
After looking at all this, it becomes hard not to agree that cybersecurity stopped being a purely technological problem a long time ago. It's still essential to invest in good tools, updated systems, and increasingly sophisticated protective mechanisms, but that's no longer enough. If the people using those systems aren't alert to the risks, all that technical effort can crumble with a single careless click.
Perhaps the real challenge of cybersecurity today isn't just protecting machines, but helping people develop a certain healthy instinct of distrust toward messages, urgent requests, or promises too good to be true. That means investing in digital literacy, teaching people from an early age to recognize warning signs, and building, within companies and institutions, cultures where it's normal and acceptable to be suspicious before acting, without fear of seeming paranoid or wasting time confirming something that seemed obvious.
It's also worth thinking about designing systems that account for the fact that people make mistakes, because that's exactly what we are: fallible, distracted, tired, and often overly trusting beings. A good security system shouldn't depend solely on the user being perfect - it should anticipate that error will happen and have mechanisms in place to reduce its consequences.
Ultimately, the most interesting lesson to take from this topic is that cybersecurity, despite its name, was never just about computers. It is, above all, about people - about how we think, trust, and react under pressure. And perhaps that's exactly why it remains so difficult to solve: there's no software update capable of fixing, overnight, what makes us human.