Initial Access in 2026 - The Power of the Spoken Word

The speakers argue that initial access has become the hardest stage of an intrusion. MFA is widespread, web application footholds are scarcer, filtered phishing is harder to land, and physical device drops are costly to arrange. A cited incident response report found social engineering in roughly a third of cases, and the talk focuses on voice-based pretexting as a route into networks.

Preparation covers target selection and tooling. Recently hired staff in non-technical roles are preferred because they are less likely to question a help desk call, and contact-lookup services help find numbers. Rigid scripts are discouraged in favor of a flexible outline, and calls are built around a calm help desk persona and a question that makes the target re-examine their own actions. Infrastructure centers on aged, generic .com domains and matching email. Caller ID is the hardest part: prepaid spoofing services stopped letting callers pick numbers, so the speakers ran their own Asterisk phone system over SIP trunks and explained how STIR/SHAKEN attestation levels affect spam labeling.

The talk closes with payload delivery through remote support tools, which the speakers said had been highly effective until recently, and with defensive advice. They recommend conditional access, identity threat detection and response, and security awareness training, while noting that behavioral baselines are hard to get right. The main takeaway is that call-based help desk processes are part of the attack surface and need verification steps that a convincing voice cannot bypass.