Elicitation

Elicitation is the practice of drawing sensitive information out of a person through what feels like ordinary conversation — without ever asking a question that would trigger suspicion. Borrowed from intelligence tradecraft, it is the quiet half of social engineering: where pretexting builds a false identity to justify a request, elicitation avoids making a request at all. The target volunteers the information, and usually never realizes a collection took place.

How it works

Elicitation exploits reliable human tendencies: the desire to be helpful, to appear knowledgeable, to correct errors, and to reciprocate openness. Common techniques include the deliberate false statement ("I heard you're still running everything on-prem" — people rush to correct the record, describing their actual infrastructure), bracketing ("your team must be, what, fifty people?" — inviting a precise correction), flattery that invites expansive answers, assumed knowledge that makes secrecy feel pointless, and quid pro quo disclosure, where the attacker shares something first so the target feels safe matching it. Fragments gathered this way — tool names, org charts, project timelines, who is on leave — rarely feel sensitive individually, but combined with OSINT they build the detailed picture that makes a later vishing call or spear-phishing email convincing.

Conferences, trade shows, sales calls, and online communities are prime venues: contexts where talking shop with strangers is the whole point, and where a well-briefed stranger asking smart questions reads as a peer, not a probe.

How to defend against it

Awareness is most of the defense, because elicitation defeats technical controls entirely. Train employees — especially sales, support, engineering, and anyone who represents the company externally — to notice conversations that keep circling toward internal details, and to feel comfortable deflecting without rudeness ("that's not something I can get into"). Define what is public, internal, and confidential so people are not improvising the boundary mid-conversation, and rehearse the scenarios: a social engineering tabletop exercise that includes a friendly stranger at a conference booth teaches the pattern faster than any policy document. Reporting matters too — a logged "odd conversation" is often the first visible trace of targeted reconnaissance.