Ep 164 - Are You Too Smart to Be Fooled? Social Engineering, Mentalism and the Age of AI
Cybersecurity professionals spend enormous amounts of time and money building sophisticated systems designed to keep attackers out. But attackers do not always need to defeat the technology. Sometimes, they simply need to convince a person to open the door. In this episode of the Security Insider Podcast, we speak with professional mentalist and illusionist Andy Nunn about what decades of deliberately deceiving intelligent, attentive audiences can teach us about social engineering, cognitive bias and human vulnerability. Andy is not a psychologist or a self-proclaimed psychic. His perspective comes from the practical mechanics of illusion: directing attention, exploiting assumptions, creating convincing narratives and watching how quickly people can become certain that their interpretation of events must be correct. We explore why high intelligence does not necessarily lead to good judgement, why expertise can sometimes create dangerous overconfidence, and how our tendency to look for evidence that confirms what we already believe can make even experienced security professionals vulnerable to manipulation. The conversation also examines the rapidly changing threat landscape created by artificial intelligence. When attackers can clone voices, generate convincing video, imitate writing styles and manufacture highly credible identities, traditional trust signals such as “I recognised the voice” or “I saw them on video” may no longer be sufficient. So how do we protect ourselves when seeing is no longer believing? Andy introduces a simple but powerful question: “What evidence could prove me wrong?” It is a question designed to challenge certainty, expose flawed assumptions and force us to distinguish between genuine verification and simply finding evidence that supports what we already want to believe. We discuss: Why intelligence and expertise do not make us immune to deception How confidence can become a security vulnerability The similarities between stage misdirection and social engineering How attackers exploit authority, urgency, familiarity and expectation Why confirmation bias can prevent us from recognising warning signs How AI-generated voices, video and identities are changing the nature of trust Why independent verification is becoming increasingly important How asking “What evidence could prove me wrong?” can interrupt manipulation Why humility may become a competitive advantage in cybersecurity The central question of the episode is simple: What if the greatest vulnerability in social engineering isn’t ignorance — but certainty?




