Modern social engineering has evolved well beyond traditional phishing emails. Today’s attacks increasingly rely on human-in-the-loop techniques , including direct interaction with help desks, executive impersonation using AI-generated voices, and the use of remote or intermediary systems to appear geographically and operationally legitimate.

These attacks routinely bypass traditional perimeter defenses such as firewalls, web application firewalls (WAFs), and IP-based controls. In many cases, attackers operate with valid credentials , access systems through real browsers, and deliberately mimic legitimate user behavior. As a result, network-centric and credential-centric security controls alone are insufficient.

The detectors described in this section are designed to identify the technical seams and inconsistencies that emerge when an attacker attempts to impersonate a legitimate user. Rather than focusing on a single signal, these detectors correlate browser behavior, device characteristics, execution environment, network routing, and organizational context. By cross-referencing real-time session data with authoritative sources such as identity provider history, HR records, and known user baselines, the system surfaces risk indicators that are difficult for attackers to fully replicate - even when authentication succeeds.

---

Detector Framework

The detection framework is organized into logical categories that reflect the different layers an attacker must control in order to convincingly impersonate a real user. Each detector contributes contextual risk signals, not binary verdicts, and is intended to be evaluated in combination with others.

Signals are collected at three levels of depth, depending on how Imper.ai is deployed:

• Web-based detection 0 Active JavaScript running in the browser at the moment of a session or interaction, requiring no software installation on the user's device.

• Point-in-time device scan - A lightweight script run on managed endpoints at the time of a verification event, surfacing device-level context not visible from the browser alone.

• Deployed agent - A continuously running agent on managed devices that builds behavioral baselines over time and detects persistent or evolving risk signals.

---

Network

Network signals evaluate how traffic is routed to the platform and whether the connection is being obscured. These detectors identify anonymization infrastructure and routing inconsistencies that attackers use to hide their true origin.

Detector	Primary Social Engineering Risk
Masked Network Connection	Use of Tor, proxies, or anonymization infrastructure to hide origin
VPN	Impersonation of remote workers or geographic alignment with a victim
Laptop Farm	Multiple employee identities sharing a residential IP or subnet, indicating a device farm or coordinated fraud operation rather than independent remote workers

Location

Location signals evaluate where access appears to originate and whether the reported location is consistent with expected user geography.

Because social engineering attacks often rely on geographic plausibility to support impersonation pretexts, location anomalies frequently expose attempts to appear legitimate.

Detector	Primary Social Engineering Risk
Unexpected Location	Location mismatches relative to HR records, CVs, or identity provider history
Restricted Region	Access from high-risk, sanctioned, or unexpected regions outside the organization's legitimate footprint

Device

Device signals focus on the hardware and execution environment used to access the platform. These detectors evaluate whether the hardware, operating system, browser, and usage history align with what is expected for the claimed user.

Attackers frequently rely on disposable, virtualized, or specially configured environments. While credentials can be stolen, reproducing a legitimate device profile over time is significantly more difficult.

Detector	Primary Social Engineering Risk
Virtual Machine	Use of disposable or isolated attack environments
Anomalous Browser	Use of anti-detect or identity-spoofing browsers
Anomalous Device	Use of attack rigs or low-end hardware inconsistent with the user profile
Device Mismatch	Session or identity hijacking from an unauthorized machine
Inconsistent Patterns	Deviations from established technical fingerprints and usage habits: browser, OS, working hours, application patterns
Anomalous Work-Only Profile	Device with months of history but zero personal activity, indicating a purpose-built impostor environment
Clean / Burner Device	Use of freshly created or wiped environments with no usage history

Tools

Tools signals detect software and hardware used to automate, remotely operate, or tamper with a session. These signals span browser-visible artifacts, point-in-time device scans, and the deployed agent.

In social engineering campaigns, this tooling appears when attackers use automation, operate a device remotely, or run attacker-oriented software during a session.

Detector	Primary Social Engineering Risk
Remote Access & Control	Hardware (KVM-over-IP) or software remote desktop tools used to operate the device from a hidden third-party location
Malicious Tooling on Device	Presence of OS-level hacking tools, exploit scripts, or attacker-oriented repositories - detected by scan or agent
Bot-like Behavior	Automation of credential abuse, brute-force attempts, or MFA guessing
Suspected Attack Device	Presence of browser-visible attacker tooling: debuggers, hacking extensions, or automation artifacts
Anomalous Input Patterns	Typing timing, key hold duration, and mouse movement shifts indicating a different person or automated input is operating the device
Virtual Audio Devices	Injection of AI-generated or pre-recorded audio into voice interactions

Identity

Identity signals evaluate the contact identifiers a user presents - email address, domain, and phone number - to determine whether they belong to a real, established identity or are disposable, virtual, or otherwise high-risk.

Attackers routinely rely on identifiers that cannot be traced back to a verifiable identity, letting them appear plausible while avoiding attribution.

Detector	Primary Social Engineering Risk
Email and Domain Checks	Use of disposable providers, newly registered or low-reputation domains, or domain inconsistencies to avoid attribution
Phone Checks	Use of virtual, VoIP, or disposable numbers to receive verification codes without a traceable identity