This weekend is busy for me — been running around doing all those family things that pile up during the week. So instead of sitting at my computer, I'm starting this draft on my phone while I'm waiting for my kids to finish. Where I'm sitting has Ocean's Eleven playing. So I'm jumping on that to build this week's topic.
There's a scene early in Ocean's Eleven where Danny Ocean lays out the plan to rob the Bellagio, the Mirage, and the MGM Grand in a single night. One vault, three casinos, a hundred and sixty million dollars. Reuben Tishkoff, the guy bankrolling the whole thing, lists off all the security they're up against: cameras watching every inch of the floor, armed guards, a vault door that requires codes from two different people, a laser grid in the elevator shaft, and "enough armed personnel to occupy Paris." Then he says, flatly, that this is why nobody has ever successfully robbed a Las Vegas casino.
Danny's response is basically… sure, but we're not going through any of that.
I've watched that movie probably a dozen times. It's a perfect heist film. It's also, and I don't think this was intentional, one of the best case studies in social engineering I've ever seen — not because the technology is realistic (it isn't, especially the EMP device, which in my non-expert opinion is science fiction wrapped in a prop), but because the strategy is real. The entire crew beats the most secure vault in Las Vegas without defeating a single technical control. Like in many of the cyberattacks we see, they go around every one of them, through the employees and through inherent trust. They exploit the basic assumption that if someone looks like they belong, they probably do.
I think about this more than a person probably should, because I see the same pattern playing out in real breaches constantly. The biggest, most expensive, most devastating compromises of the last few years didn't happen because someone broke the encryption or defeated the firewall. They happened because someone called a help desk, sent a text, or impersonated a person who should have been there. The attackers, like Danny Ocean, looked at the vault door and said: sure, but we're not going through that.
Let me walk through the crew — because each one of them maps to a real attack technique that's in use right now, against organizations that have spent millions on protecting what's in the vault.
Start with Linus Caldwell (Matt Damon's character). He's a pickpocket by training. In the film, his most important job isn't stealing wallets on the street — it's infiltrating the casino as a state gaming commission official. He puts on a suit, prints a fake ID, and walks into Terry Benedict's world as someone who has authority and a reason to be there. Benedict doesn't question it because the costume is right, the confidence is right, and why would he? The gaming commission shows up all the time.
That's pretexting. It's one of the oldest social engineering techniques in existence and it still works because it exploits the same vulnerability every time: we trust people who present the right credentials in the right context. In September 2023, a group called Scattered Spider called the MGM Resorts help desk. They'd done their homework first. They knew enough about an employee to convince the help desk agent that they were that person. The agent reset the password and the MFA factor — which is exactly what you'd do if a legitimate employee called and said they were locked out. One phone call. About ten minutes. That single call led to a breach that cost MGM approximately $100 million and shut down casino operations for ten days. The slot machines went to cash-only. Room keys stopped working. Their website went dark.
The attacker didn't "hack" anything in the traditional sense. They called and asked nicely, with the right information, and the system did what it was designed to do. In this analogy, that's Linus with the gaming commission badge — but the trust was real.
Now look at Livingston Dell (Eddie Jemison), the surveillance and electronics guy. In the film, he taps into the Bellagio's own camera system. He doesn't build his own cameras — he just uses theirs. His job is reconnaissance: watching the casino's routines, learning the guard rotations, understanding the patterns the security team follows every day without thinking about them. By the time the heist starts, the crew knows the casino's operations better than most of the employees do.
(I hope that just caused you to wonder where your patterns are.)
Scattered Spider did the same thing before they called MGM. They scraped LinkedIn and other professional networks to gather employee names, job titles, reporting structures, office locations, and start dates — the kind of information a help desk typically asks callers to confirm. It's also the kind of information most professionals put online voluntarily, because that's what LinkedIn is for. The attackers didn't break into a system to get that intelligence. They read public profiles. Like most big attacks, they did their homework the way a first-year analyst does threat intelligence. The information was just… there.
This makes me uncomfortable, and I'll say why. I host a podcast where I talk about my views. I write articles. I have a LinkedIn profile that lists my job title, my employer, and enough about my career that a halfway competent attacker could build a solid pretext around me in twenty minutes. We encourage employees to maintain professional profiles, display our organizations and projects. Those are all good things. They're also a reconnaissance goldmine for anyone who's paying attention. I'm not saying everyone should delete their LinkedIn — I have one, it's fine — but it's worth acknowledging that the information we put online to build our professional reputations is the same information attackers use to build pretexts.
Then there's Saul Bloom (Carl Reiner), the elder con artist. His job in the heist is to impersonate a wealthy international arms dealer named Lyman Zerga. He shows up at the Bellagio with an expensive suit, an accent, and a briefcase that he convinces Terry Benedict to store in the vault for safekeeping. Benedict agrees because this is a high-roller asking for a reasonable accommodation, and casinos do this for VIPs all the time. What Benedict doesn't know is that the briefcase contains the disguised explosives the crew needs to blow the vault locks from the inside.
In security terms, Saul is the supply chain attack vector. He gets malicious payload past the perimeter by wrapping it in something that looks legitimate and coming through a trusted channel. Nobody x-rays the high-roller's briefcase because high-rollers are good for business. Nobody questions the vendor's software update because the vendor is trusted. ShinyHunters pulled a version of this against ADT earlier this year. A voice-phishing call compromised an employee's Okta single sign-on credentials. Once they had a valid SSO session — the briefcase in the vault — they used it to access ADT's Salesforce environment and walked out with data on millions of customers. The initial entry wasn't a zero-day exploit. It was a phone call where someone pretended to be IT support and walked the employee through a fake login page in real time.
That last detail is what gets me. The attacker posed as the person who helps. They pretended to be IT support — the very people whose job is to protect you — and used that trust to take what they wanted.
That brings me to the fake SWAT team.
This is my favorite part of the heist, and the one with the most direct parallel to real-world attacks. During the robbery, the crew triggers an alarm that forces Benedict to call 911. Except the crew has intercepted the call, and the SWAT team that shows up at the Bellagio isn't SWAT — it's Danny's crew in tactical gear and helmets. They "respond" to the crisis, "secure" the vault, and walk out with duffel bags full of cash while Benedict watches on his own cameras, believing law enforcement just saved his money.
An attacker posing as the defender. We've seen this in the wild. Scattered Spider reportedly did it to Caesars Entertainment around the same time as the MGM attack — same playbook, different target. Caesars paid approximately $15 million in ransom. The Twilio breach in 2022 used SMS phishing messages that appeared to come from Twilio's own IT department, directing employees to fake login pages. The message said their passwords were expiring, and it looked like a legitimate security notification because it was designed to look like one.
Think about what that actually exploits. It doesn't exploit a software vulnerability — it exploits the relationship between a person and the system that's supposed to protect them. When the fake SWAT team walks through the door, Benedict doesn't question them because SWAT is exactly who should be showing up. When a fake IT support message hits an employee's phone, the employee doesn't question it because IT is exactly who would send that. The disguise isn't just visual — it's contextual. The attacker appears at the right time, with the right message, in the right format, and the target's own mental model of "this is normal" does the rest.
Now let me talk about the vault itself, because this is where the analogy gets pointed.
Terry Benedict's vault is, by any reasonable measure, incredible. Steel-reinforced walls, a door that requires codes from two different people who don't know each other's codes, a laser grid in the elevator shaft, biometric checks, armed guards on rotation, and cameras on everything. He spent a fortune on it. It is, without question, technically impressive.
The crew never defeated any of it. None of the controls were even touched. They went around the laser grid by cutting power with an EMP (unrealistic — go with the metaphor). They got Yen inside the vault through a trolley, bypassing the door entirely. They blew the locks from the inside using explosives they'd already gotten past the perimeter through Saul. They replaced the live camera feed with footage from a replica vault they'd built, so Benedict was literally watching the wrong thing at the moment it mattered most. He was staring at his monitors, seeing what he expected to see, completely confident that his surveillance was giving him an accurate picture. It wasn't. The images were real. The situation they depicted was fiction.
I've seen this in security operations, and most likely you have too. The dashboard is green. The metrics look healthy. SLA targets are met. Everything appears normal, and the appearance of normal is so comforting that nobody asks whether the picture they're looking at is actually the whole picture. (I hate when things look normal.) The crew didn't need to disable Benedict's cameras. They just needed to control what the cameras showed him. The lesson isn't that monitoring is useless — it's that monitoring only works if you're seeing what's actually happening, not what someone wants you to see.
Every dollar Benedict spent on the vault was rendered irrelevant by the crew's ability to exploit people and processes. The vault was strong. The trust model was weak. The thing that failed wasn't the technology. It was the assumption that if your technical controls are good enough, you don't need to worry about the human layer.
I see this constantly. Organizations that spend seven figures on endpoint detection, SIEM platforms, network segmentation, zero trust architecture, next-gen firewalls — whatever "next-gen" means this quarter — and all of it gets bypassed by someone who calls the help desk with a convincing story. The Verizon DBIR has said for years that the human element is involved in the majority of breaches. The 2024 report put it at 68%. We know this. We've known it for a decade, and we keep building better vaults anyway, because vaults are tangible. You can point at a vault. You can demo a vault. You can put the vault in a slide deck with a dollar figure and a deployment timeline and a green checkbox. Try putting "our help desk staff are really good at spotting pretexting" in a board presentation and see how that lands.
I'm not saying technical controls don't matter — they do, and I keep saying that. The vault kept everyone else out. It kept out the opportunists, the smash-and-grab crews, the people who weren't willing to spend months planning an operation. Technical controls raise the bar, and raising the bar matters. But when the threat actor is sophisticated enough to go around the technical controls entirely — and that bar is getting lower every year — what you're left with is the human layer. The help desk agent who has to decide in real time whether the person on the phone is who they say they are. The employee who gets a text that looks like it's from IT. The executive assistant who gets a voicemail from the CEO asking for an urgent wire transfer.
Those people are your last line of defense, and most organizations train them with a 30-minute annual video and a quarterly phishing simulation that everyone knows is a phishing simulation because it comes from the same platform and uses the same awkward phrasing every time. That's not training. That's a checkbox. It's Benedict watching his cameras and believing the feed is real.
Real training for social engineering means teaching people to recognize context manipulation, not just suspicious links. It means running scenarios that are actually hard — where the pretext is good and the pressure is realistic and the right answer is to slow down and verify even though that feels rude or inefficient. It means giving the help desk explicit permission and a clear process to push back on callers who can't pass a verification that goes beyond "what's your employee ID and your manager's name." It means building a culture where an employee who reports a suspicious call gets thanked, not questioned about why they didn't just help the person. It takes thought, investment, and a willingness to make the customer-service metrics look slightly worse in exchange for actually verifying identity.
I want to be careful here, because I don't want this to sound like I'm blaming the people who get socially engineered. The MGM help desk agent did what help desk agents are supposed to do: help people who are locked out. The ADT employee followed what appeared to be a legitimate IT process. The people who fell for these attacks weren't stupid. They were operating inside systems that weren't designed for the threat they faced — which is a leadership failure, not a user failure.
I've been in incident response debriefs where the root cause of a significant compromise was "someone called and asked." Not "someone exploited a buffer overflow." Not "someone used a zero-day." Someone called and asked, and the person on the other end of the phone did their job, which was to be helpful. The system worked exactly as designed. The design was the problem.
That's the real lesson from Ocean's Eleven, and I mean this seriously despite the clumsy movie metaphor (I told you I'd call it out). Danny Ocean didn't beat the vault. He beat Terry Benedict's security model — one that Benedict designed for the wrong threat, because he assumed the attack would come through the vault door, so he built the best vault door money could buy. The attack came through the people, the processes, and the assumptions, and he'd invested almost nothing there.
How many of us are doing the same thing? I know I've been guilty of it. I've spent budget cycles fighting for better tools, better detection, better network architecture, and comparatively little on the human factors that — statistically — are how most breaches actually start. Not because I don't know the data, but because the tools are easier to buy, easier to measure, easier to present to a board, and easier to feel confident about. "We deployed zero trust" sounds better in a board presentation than "we redesigned our help desk verification process and spent three months training our staff on pretexting scenarios." One of those is a vault. The other is the thing that actually stops Danny Ocean.
The uncomfortable question I keep coming back to: if an attacker called your help desk tomorrow with a well-researched pretext — using an employee's name, title, manager's name, and office location, all pulled from LinkedIn in fifteen minutes — what would happen? Would the help desk agent have the training, the tools, and the organizational support to recognize it and push back? Or would they do what help desk agents are incentivized to do, which is resolve the ticket, help the caller, and move on to the next one?
If you're not sure, you might want to think about that. Because Scattered Spider isn't a crew of eleven people planning an elaborate heist in a warehouse. They're kids. Some of the people arrested in connection with these attacks were teenagers. They didn't need millions of dollars in backing or months of planning. They needed a phone, a LinkedIn profile, and a help desk that was designed to be helpful.
Danny Ocean had a crew of eleven specialists, months of planning, a replica vault, and an EMP device that doesn't exist in real life. Today's attackers need a lot less. The barrier to entry for social engineering is a phone and homework. The tools are free. The information is public. The techniques are documented.
The vault is nice. It really is. But if someone can walk through the front door with a fake badge and a good story, the vault doesn't matter.
Are we securing the vault, or are we securing the building?