Social engineering tests an organization's susceptibility to manipulation and typically involves tactics like phishing, impersonation, or pretexting.