An IT security analyst is conducting a vulnerability assessment for a multinational financial institution. During a staff briefing, they highlight that the primary threat vector to their network is 'social engineering'.