The real weapon behind most cyber attacks isn't code. It's conversation.
Someone calls your IT helpdesk. They sound calm, professional, and helpful. They know the name of an employee. They say there's been a problem with a login and they need a password reset.