Ep 164 - Are You Too Smart to Be Fooled? Social Engineering, Mentalism and the Age of AI
ASIAL Security InsiderShow Notes
Cybersecurity professionals spend enormous amounts of time and money building sophisticated systems designed to keep attackers out. But attackers do not always need to defeat the technology. Sometimes, they simply need to convince a person to open the door.
In this episode of the Security Insider Podcast, we speak with professional mentalist and illusionist Andy Nunn about what decades of deliberately deceiving intelligent, attentive audiences can teach us about social engineering, cognitive bias and human vulnerability. Andy is not a psychologist or a self-proclaimed psychic. His perspective comes from the practical mechanics of illusion: directing attention, exploiting assumptions, creating convincing narratives and watching how quickly people can become certain that their interpretation of events must be correct.
We explore why high intelligence does not necessarily lead to good judgement, why expertise can sometimes create dangerous overconfidence, and how our tendency to look for evidence that confirms what we already believe can make even experienced security professionals vulnerable to manipulation. The conversation also examines the rapidly changing threat landscape created by artificial intelligence.
When attackers can clone voices, generate convincing video, imitate writing styles and manufacture highly credible identities, traditional trust signals such as “I recognised the voice” or “I saw them on video” may no longer be sufficient.
So how do we protect ourselves when seeing is no longer believing? Andy introduces a simple but powerful question:
“What evidence could prove me wrong?”
It is a question designed to challenge certainty, expose flawed assumptions and force us to distinguish between genuine verification and simply finding evidence that supports what we already want to believe.
We discuss: Why intelligence and expertise do not make us immune to deception How confidence can become a security vulnerability The similarities between stage misdirection and social engineering How attackers exploit authority, urgency, familiarity and expectation Why confirmation bias can prevent us from recognising warning signs How AI-generated voices, video and identities are changing the nature of trust Why independent verification is becoming increasingly important How asking “What evidence could prove me wrong?” can interrupt manipulation Why humility may become a competitive advantage in cybersecurity
The central question of the episode is simple: What if the greatest vulnerability in social engineering isn’t ignorance — but certainty?
More from ASIAL Security Insider
A new and disturbing form of violent extremism is spreading across online communities, and unlike traditional extremist movements, it isn't necessarily driven by politics, religion or ideology. Instead, it's fuelled by manipulation, psychological exploitation, cruelty and the pursuit of notoriety.
In Part One, we explored the key findings from ASIAL’s landmark Security 2030 report, discussing regulatory reform, procurement challenges, industry visibility and the structural issues that must be addressed if the sector is to meet the demands of the future.
Australia’s private security industry is entering a period of significant change. New technologies, evolving threats, workforce challenges, regulatory reform and increasing expectations around professionalisation are reshaping what security will look like over the next five years.
Australia’s critical infrastructure operators are entering a new phase of security and risk management. With enhanced obligations under the Security of Critical Infrastructure (SOCI) Act, rapidly advancing artificial intelligence, and growing supply chain vulnerabilities, organisations must rethink how they identify, manage, and respond to emerging threats.
Crowded public spaces present a unique security challenge. They must remain safe and resilient while also feeling open, welcoming and accessible.