A computer-implemented method comprising: identifying, by a computing device, a first characteristic of a first communication received on a first communication channel, wherein the first characteristic is determined based upon, at least in part, a first set of text in the first communication and sent on the first communication channel; identifying a second characteristic of a second communication received on a second communication channel, wherein the second characteristic is determined based upon, at least in part, a second set of text in the second communication and sent on the second communication channel; comparing, with a predetermined rule, both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel; determining that both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel correlates to the predetermined rule by performing an assessment of the first set of text in the first communication and the second set of text in the second communication compared to at least one of malicious or non-malicious communications; and identifying potential social engineering activity associated with at least one of the first communication or the second communication based upon, at least in part, correlating both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel to the predetermined rule. identifying, by a computing device, a first characteristic of a first communication received on a first communication channel, wherein the first characteristic is determined based upon, at least in part, a first set of text in the first communication and sent on the first communication channel; identifying a second characteristic of a second communication received on a second communication channel, wherein the second characteristic is determined based upon, at least in part, a second set of text in the second communication and sent on the second communication channel; comparing, with a predetermined rule, both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel; determining that both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel correlates to the predetermined rule by performing an assessment of the first set of text in the first communication and the second set of text in the second communication compared to at least one of malicious or non-malicious communications; and identifying potential social engineering activity associated with at least one of the first communication or the second communication based upon, at least in part, correlating both the first characteristic of the first communication received on the first communication channel and the second characteristic of the second communication received on the second communication channel to the predetermined rule.