2025 Unit 42 Global Incident Response Report: Social Engineering Edition Reveals 36% of Cyber Incidents Began with Human Manipulation

Palo Alto Networks, the global cybersecurity leader, has recently released its 2025 Unit 42 Global Incident Response Report: Social Engineering Edition. The report highlights how attackers have been increasingly turning to social engineering, exploiting trust rather than technology to gain initial access and move inside organizations. 

Drawing from more than 700 incident response cases globally between May 2024 and May 2025, the report reveals that 36% of all incidents in the IR caseload began with a social engineering tactic. These tactics are increasingly diverse, with more than one-third of social engineering incidents involving non-phishing methods such as search engine optimization (SEO) poisoning, fake system prompts, and help desk manipulation.