“Defending against technology-based attacks like malware necessitates the use of technology controls but defending against social engineering becomes a mental game,” says Chris Morales, head of security analytics at Vectra.