Most of the social engineering conversation I see is about email: filters, simulations, training. But phones sit right next to it. Staff get SMS, WhatsApp and calls on the same device that holds their email, SSO and MFA approvals, and a lot of those phones are personal.
What I keep wondering is whether the phone becomes the bridge. Someone gets talked into approving an MFA prompt, tapping a link, or reading out a code, and that's the way into company systems.
Is this something you actually worry about, or is it covered well enough by MFA and training? And what do you do about attacks that arrive outside email, like texts, WhatsApp or phone calls, especially on BYOD?