A penetration tester has prepared the following phishing email for an upcoming penetration test: Which of the following is the penetration tester using MOST to influence phishing targets to click on…

While familiarity can play a role, authority from a perceived legitimate sender and urgency for immediate action are generally stronger and more direct drivers for a click in a professional phishing context.

Phishing emails often leverage principles of social engineering such as authority and urgency; authority is typically established by impersonating a known or credible source, while urgency is created by implying immediate action is required to avoid negative consequences or seize a limited opportunity, thus encouraging hasty clicks.

Scarcity and fear can be used, but urgency is often intertwined with fear, and authority (impersonating a legitimate source) often precedes or enables the fear or urgency, making authority and urgency a more encompassing choice.

Social proof and greed are social engineering tactics, but social proof is not directly implied by a single email, and while greed might be used, authority and urgency are more broadly applicable and potent in typical enterprise phishing scenarios.