Time to Read: 6 mins
It's 7:30 in the morning, and I'm eating breakfast in a dining hall that's been feeding students for centuries, and nuns before that.
The tall wooden ceilings, the stone walls, the stained glass windows casting a glow on my breakfast plate...
It honestly feels otherworldly.
I'm a long way from home, traveling solo, running on very little sleep, and surrounded by strangers. This introvert is so out of her comfort zone.
But I wouldn't trade it for the world.
I flew to England for a long weekend at the University of Cambridge, where I stayed at Jesus College (one of the University's 31 colleges), toured the campus with an alum, went punting down the Cam, and talked with as many students, fellows, and locals as I could.
But the real reason I went? A lecture on social engineering.
Yes, a leadership coach flew across the Atlantic for a lecture about cybercrime.
Here's why.
I spend my days helping leaders understand how their thinking shapes their decisions. And social engineering is, at its core, an attack on thinking. It's a deliberate attempt to steer how you feel, think, and decide in the moment, so you end up acting in accordance with someone else's agenda.
That puts it squarely in self-leadership territory. Which also makes self-leadership an antidote, of sorts.
But I’m getting ahead of myself.
If you’re not familiar, social engineering is a pervasive manipulation tactic. It’s essentially where someone (or a company, government, etc.) gets you to hand over information, access, or money by tapping into your psychology.
Nothing gets hacked, per se. You’re socially engineered (manipulated) to open the door and let them in.
And it's an issue that’s becoming more and more prevalent. In 2025, the FBI received more than a million cybercrime complaints, with reported losses of nearly $21 billion, a 26% jump from the year before. The most reported type was phishing and spoofing, where someone poses as a person or organization you already trust.
And it happens on the daily. An email that looks like it came from your boss asking you to buy e-gift cards for a client. A "bank representative" who calls and needs your verification code right now. A text from a delivery company urging you to click the link to reschedule your package.
To understand why these tactics work, we have to go old school and revisit Aristotle’s three pathways of persuasion: ethos, pathos, and logos.
Ethos is credibility. The attacker poses as someone you already trust or feel obligated to obey, such as your CEO or your bank. The logo and email address may look official, or the caller may know certain details about you. You unwittingly drop your guard before the request is even made.
Pathos is emotion. Fear, urgency, embarrassment, or the desire to be helpful can all be triggered. A message like “your account has been compromised” or “I’m stuck and need this right away” sparks emotional reactivity, making it harder to stop and evaluate the request.
Logos is logic. The story needs to feel plausible, which is why social engineers often have reasonable-sounding explanations, such as a deadline, a company policy, or a routine verification step. When the details line up, the request feels legitimate, even when it’s not.
When ethos, pathos, and logos are intertwined, you get a message that feels credible, urgent, and sensible all at the same time.
And here’s the a-ha I had while sitting in that lecture hall: each of these appeals works because of a thought you have in response to it.
Ethos works through an assumption. When a message looks like it’s from your CEO, you don’t sit down and decide to trust it. The assumption is already there: “That’s my boss, so it must be legit.” An assumption you haven’t examined becomes an open door.
Pathos works through your self-talk. Urgency and emotion trigger a thought like “I have to deal with this right now.” Once that thought is running, the space where you’d normally ask questions disappears, and you take quick action in response.
Logos works through a thinking error where you mistake plausible for verified. “That makes sense, so it must be true.” A story can be perfectly logical and still be false.
So the attack doesn’t really happen in your inbox or on your phone. It actually happens in your thinking.
And it turns out, my a-ha fits with what researchers found when studying why people get phished. Most people process phishing emails peripherally. Meaning, they decide based on quick cues, like whether something looks official or sounds urgent, instead of carefully evaluating the message.
This mental shortcut is where we become vulnerable. This is also why being smart doesn’t automatically protect us. What actually matters is whether you’re slowing down enough to evaluate the situation.
And AI is only making this harder. It can mimic writing styles, copy voices, and produce convincing impersonations, creating challenges around who or what to believe.
Unfortunately, the lecturer’s final conclusion was that “there is no foolproof remedy”, so the best bet is to “be skeptical.”
Which ultimately means we have to take matters into our own hands. Thankfully, we already have the tool for doing so… our own thinking! It's our best defense.
Which brings us back to Self-Leadership: Pillar #1 - How You Think.
Pillar #1 is about noticing your thoughts, questioning your assumptions, and interrupting your autopilot before it drives your actions.
It helps you be appropriately skeptical by creating a gap between the message and your response. And it’s how you protect your mind, money, and decisions in a world that’s trying to get at all three.
Yep, self-leadership is that important — a fact I’m continually reminded of, all across this globe.
💡 Practionable Takeaway
One way to protect yourself from social engineering is to pay attention to messages designed to make you act quickly. Often, they’re trying to get you to click a link, fulfill an urgent request, or share a post because everyone "needs to see this!"
➡️ Catch the thought. Name what you're telling yourself. "I have to do this now." "This must be real." Naming it creates a pause.
Then, in that gap, work through the three appeals:
1️⃣ Ethos: Why am I trusting this source?
Have I verified who's behind the message, or am I relying on a familiar name, an official-looking logo, or someone else's endorsement?
2️⃣ Pathos: What am I feeling compelled to do?
Am I afraid something will happen if I wait? Worried about disappointing someone? Excited because this confirms what I already thought? Give yourself time to notice how that feeling is influencing your response.
3️⃣ Logos: What have I actually verified?
Does the explanation simply sound reasonable, or do I have evidence that supports it? What would I need to check before moving forward?
Being willing and able to say, "Let me check that first," is a small self-leadership practice with very practical benefits.
🎥 Want to Go Deeper?
A deeper understanding of your own thinking patterns makes “Let me check that first” a lot easier to say and do. Thankfully, there’s a tool for that. 😉
If you haven’t yet taken the Self-Leadership Assessment, now’s your chance. It’s free, takes less than 10-minutes, and will provide you with a customized report at the end.
AND… just this week, I finalized a form-fillable Self-Leader’s Playbook, complete with 10 research-backed experiments to help build your self-leadership muscle.
It’s so new that it’s not even on my website yet! But if you want a copy, just reply to this email and I’ll send it to you.
To Your Success,
Laura 💜🧡
Responses