Most security technology defends a machine. Social engineering attacks the person at the keyboard — it convinces them to click, to approve, to wire the money — and the machine does exactly what it is told. That is what makes it the hardest threat to catch in software: there is often no malware, no exploit, just a convincing message and a human acting on it.
So how do you detect an attack whose payload is persuasion? ExtraHop's grant US12652312B1, "Detecting social engineering threats" (issued June 9, 2026), sits squarely on this problem. Its single CPC classification is telling: H04L 63/1483 covers protecting against attacks where a malicious party masquerades as a trusted entity — the technical heart of phishing and impersonation. The detection looks for the fingerprints of impersonation rather than a malicious file.
The mechanism, in plain terms: instead of scanning for bad code, this class of system looks for the context of deception — a message or request that imitates a trusted source, an interaction pattern that does not match how a real counterpart behaves. ExtraHop's lineage is network detection, so the signal here is behavioral and relational, not file-based: who is talking to whom, claiming to be what, and does that hold up.
The practical takeaway for defenders is sobering and useful at once. Because the target is human, no detector is a substitute for the boring controls that blunt social engineering when it works: multi-factor authentication, out-of-band verification for payments, and least privilege so a tricked user cannot reach much. Detection raises the odds of catching the attempt; the controls limit the damage when detection misses.
Why it matters for the beat: a large share of disclosed breaches start with social engineering — a credential phished, an MFA prompt fatigued into approval. When you read an incident report that begins with "an employee was deceived into," this patent describes the layer that tries, imperfectly, to flag that deception in motion. It is a method, not a promise; the durable defense is still the assumption that someone will eventually be fooled, and an architecture that survives it.