Why Public Sector Organisations Are Prime Targets for Social Engineering

Public sector organisations are responsible for some of society's most valuable assets. From healthcare records and financial information to education systems and local government services, they manage vast amounts of sensitive data while delivering services that millions of people rely on every day. It's no surprise, then, that they're a frequent target for social engineering attacks.

While technical vulnerabilities often dominate cyber security conversations, our research found that 68% of organisations identify employees as their greatest cyber risk. That risk becomes even more significant when you consider that phishing remains the most common and disruptive form of cyber-attack experienced by UK organisations, according to the UK Government's Cyber Security Breaches Survey

As attackers continue to exploit human behaviour alongside technology, helping employees recognise and respond to manipulation has become just as important as strengthening technical defences.

Understanding why the public sector is such an attractive target is the first step towards reducing that risk.

A Wealth of Valuable Information

The public sector holds an extraordinary breadth of information. Patient records, tax information, social care data, education records and government documentation all have significant value to cybercriminals.

Unlike payment card information, which can often be cancelled quickly after compromise, many forms of this personal data remain valuable for years. Criminals can combine the information stolen from different sources to support identity fraud, financial crime or increasingly convincing social engineering attacks.

For attackers, successfully compromising a single employee can sometimes provide access to far more than one individual account. It can open the door to sensitive systems, confidential records or trusted communication channels that allow an attack to spread further throughout an organisation.

This makes people an attractive entry point, particularly when technical security controls are becoming increasingly difficult to bypass.

Public Sector Environments Create Opportunities for Social Engineering

Public sector organisations also operate in environments that naturally create opportunities for attackers to exploit trust.

Large workforces often include permanent employees, contractors, agency staff and volunteers, all with different responsibilities and varying levels of digital confidence. Teams work across multiple locations, with many employees balancing busy workloads while delivering frontline services, where responding quickly is essential.

Attackers understand these pressures. A convincing phishing email appearing to come from a trusted colleague, supplier, or even a senior leader can easily blend into a busy working day. Requests that appear to follow familiar business processes often feel routine, making it much easier for attackers to persuade someone to act before stopping to question the request.

The use of AI is making these attacks even more convincing. Phishing emails are becoming more polished, messages can be tailored to specific organisations or departments, and fraudulent communications increasingly resemble the genuine correspondence employees deal with every day. The UK Government's Cyber Security Breaches Survey also found that many organisations believe phishing attacks have become easier for cybercriminals to carry out, contributing to an increase in attack volumes.

Social engineering succeeds because it exploits normal human behaviour. Most people just want to get their job done. They want to help colleagues and respond quickly when requests arrive. Attackers take advantage of those instincts.

Human Risk Goes Beyond Individual Mistakes

When a social engineering attack succeeds, it's easy to focus on the employee who clicked a link or shared information. In reality, these incidents are rarely the result of a single poor decision.

Employees make decisions within the environment they're given. If security awareness training is infrequent, overly generic or disconnected from the situations people face, it becomes much harder for individuals to recognise sophisticated attacks when they appear.

Our research reinforces this challenge. 81% of organisations today believe their current security awareness training is too generic to feel personally relevant and therefore, be effective, while 75% say employees don't fully understand the role they play in managing and preventing cyber risk.

Building resilience means creating a work environment where employees feel confident questioning unusual requests. They should also know when to report suspicious activity and know the role they play in protecting the organisation. Those behaviours develop over time through regular reinforcement and relevant learning that reflects the situations people genuinely face in their roles, rather than a single annual compliance exercise.

Strengthening Human Defences Against Social Engineering

Reducing the risk of social engineering doesn't always require significant investment. Consistent improvements to security awareness programmes can make a meaningful difference.

Today’s security awareness training should reflect the real situations employees encounter in their own roles, using realistic risk scenarios that mirror genuine phishing attempts and social engineering techniques.

Conducting short, year-round learning is also more effective than relying solely on annual mandatory courses, as it helps secure behaviours become part of everyday working practices.

Finally, organisations should look beyond training completion rates when assessing their security risk levels, and start measuring how often employees report suspicious emails, where people continue to struggle and whether confidence is improving over time.

Building Resilience Starts with People

Public sector organisations will always be attractive targets because of the essential services they provide and the sensitive information they protect. While technology remains a critical part of any security strategy, today’s attackers continue to demonstrate that people are often the most effective route into an organisation.

Creating a culture where employees understand the tactics used by cybercriminals, feel confident responding to suspicious activity and recognise the role they play in protecting public services is one of the most effective ways to strengthen resilience against social engineering.

To explore practical approaches to reducing human cyber risk across the public sector, visit us at DigiGov Expo – Stand G10 to continue the conversation.