Today, the majority of cyber attacks include some form of social engineering when humans are targeted and unwittingly exploited as part of the overall incident. Attackers take their time and invest resources to do background research the organization they plan to attack, searching for those staff that are ‘soft target’s who may provide the path of least resistance for access. In response, organizations are fighting back. This presentation will provide case studies for organizations that use forensics and data analysis to help them understand which parts of their business are the most vulnerable to social engineering, due to both staff behavior and technical profile. These case studies will demonstrate that by identifying, empowering and tracking the most vulnerable it is possible to improve an organization overall security awareness & culture which ultimately reduces risk of social engineering.