Improv Comedy for Social Engineering

Ross Merritt, a security consultant with a background in improv comedy, opens by framing social engineering as a game. He argues that the mindset needed for pretext calls and phishing work resembles the one performers use on stage, and that the session would use improv training to build the fast reactions, presence and calm that help when operating in unfamiliar situations.

The workshop runs through a series of short group exercises. Zip Zap Zop trains attentive communication while tracking what is happening around you, and a ball-passing game adds a second object to test whether people can follow several things at once. The "yes, and" principle is presented as a way to absorb whatever a target says and build on it, rather than running into a dead end with yes-or-no questions. Volunteers also performed a three-sentence scene, where a short exchange had to reveal the relationship between two characters, practising rapport and adapting on the fly.

The closing message is that confidence and a willingness to look foolish matter more than a rehearsed script, and that failure is a normal part of improving. Attendees were encouraged to seek out a local improv group to keep building these skills, and the session ended with an open invitation for questions.