Social engineering
Manipulate a person, skip the software flaw. Phishing, vishing, BEC, and the helpdesk reset are all this family.
Social engineering is getting a human to do a thing or hand over a thing: a password, a code, a wire, a door. The bug is courtesy, fear, and urgency — not a CVE.
Build processes that survive a convincing caller: no password over the phone, out-of-band checks for payments, MFA that is not push-fatigue, and permission to slow down. Technical controls still matter because people will click. Design for that Tuesday.
Fact source: ASD's ACSC glossary.