A quick note before we start. This is the first Access Logs Footnote. The regular Access Logs entries are stories from the field, actual engagements, actual doors, actual people. A Footnote is a little different. It is still about this work and the way we think about it, but instead of walking you through a job, it steps off to the side for a minute. Think of it like the note at the bottom of the page, tied to the main story but pointed somewhere a little more personal. With that out of the way, let's talk about movies.

A few months ago I found myself rewatching Ferris Bueller's Day Off for probably the hundredth time.

Like a lot of people my age, I've seen it enough times that I can quote parts of it from memory. The same goes for the Beverly Hills Cop series, Fletch, Fletch Lives, 48 Hrs, Another 48 Hrs, and a handful of other movies that seemed to live permanently in the VCR when I was growing up.

My dad was a huge movie fan. Sword and sorcery films, action movies, comedies, John Hughes movies; if he didn't own the movie, he would for sure find a way to get it or record it. We spent a good amount of time at movie rental spaces on the weekend for a family movie night, even if it turned out to be Critters or Terminator, and it helped that Movie Warehouse was within walking distance from where we lived at one time.

Looking back, I realize something interesting about many of the characters I gravitated toward as a kid. They weren't necessarily the toughest guys in the room. They were the smartest. Specifically, they understood people and how the daily grind can make people vulnerable.

At the time, I couldn't have told you what social engineering was. I wouldn't learn that term for many years. Yet when I look back at some of my favorite characters from those films, I realize many of them were doing exactly that. They just called it being clever.

Axel Foley and Reading the Room

Take Axel Foley from Beverly Hills Cop. Most people remember the banana in the tailpipe, the Detroit Lions jacket, and Eddie Murphy's nonstop humor. What I remember is a guy who could walk into almost any environment and somehow find a way to make it work in his favor. He didn't belong in Beverly Hills, and that was the entire point.

The police didn't want him there. The wealthy elites didn't want him there. The hotel staff didn't want him there. Yet time and time again he found ways around obstacles by understanding people better than the people around him understood themselves.

He could build rapport in seconds. He knew when to make someone laugh, when to appeal to authority, when to create urgency, and when to simply overwhelm someone with confidence.

Years later, after conducting social engineering assessments, Red Team operations, and covert entry services, I realized that many of the same principles had been sitting right there in front of me when I was a kid, and they subconsciously helped guide me through a long career in this line of work. This was even before I ever saw Hackers or Sneakers.

Ferris Bueller and Weaponizing Expectations

Let's look at Ferris Bueller.

Ferris never picked a lock. Although he was technically savvy for the time, he never hacked a computer (unless you count War Games). He never bypassed an access control system. Instead, he manipulated assumptions.

The entire movie works because Ferris understands what people expect to see. His parents expect a sick kid in bed. His teachers expect a student who is absent. His sister expects him to eventually get caught. Principal Rooney expects Ferris to make a mistake. Ferris spends the entire movie weaponizing expectations.

Looking back, that's one of the most important lessons in social engineering. People rarely see what is actually happening. More often, they see what they expect to be happening. My father, who is also a magician, would say, "That is why magic often works too, especially against other magicians."

I've seen that play out during security assessments more times than I can count. People see a HID badge with a similar looking lanyard and assume someone is legitimate. People see confidence and assume authority. People hear a convincing story and stop asking questions.

Ferris understood that long before most of us ever heard the term "human vulnerability."

Fletch and the Power of Commitment

Then there's Fletch. Honestly, Fletch may be the closest thing Hollywood has ever produced to a social engineer. The entire movie is one pretext after another: doctor, businessman, mechanic, inspector, rancher. He becomes whatever he needs to be at that particular moment.

What made those scenes work wasn't the disguise. It wasn't the costume. It wasn't even the ridiculous names. It was commitment.

Fletch fully committed to every role he played. He understood that people are often more willing to accept an explanation than challenge one. He knew that confidence fills in a lot of gaps.

That lesson holds up surprisingly well today.

The Psychology Hasn't Changed

When people talk about social engineering in 2026, the conversation almost immediately turns to AI: voice cloning, deepfakes, AI-generated phishing emails, and synthetic identities built to fast-track rapport.

Those threats are real, and they're becoming more accessible every day. A threat actor can accomplish things in minutes that would have taken significant time, money, and effort only a few years ago.

The technology is impressive.

What isn't new is the psychology behind it all.

A cloned voice only works because someone trusts the voice. The technology has evolved, but the target remains the same: people.

That's why I think it's a mistake to view social engineering as an information technology problem.

It's a human problem.

Always has been.

One of the things that continues to surprise me after years of conducting Red Team services is how effective in-person social engineering remains. While organizations focus heavily on phishing simulations and AI-powered threats, many still struggle with the fundamentals of human interaction. It is why having social engineering in your pocket during covert entry engagements is so important.

People want to be helpful, and they don't like confrontation. People trust confidence and respond to familiarity. None of those things require artificial intelligence or any high-tech trick to get past healthy suspicion. They simply require understanding how humans operate. In many ways, that's what made those movie characters so compelling.

Axel Foley wasn't the hero because he was stronger than everyone else. Ferris Bueller wasn't interesting because he was technologically sophisticated. Fletch wasn't successful because he had better tools.

They succeeded because they understood people.

As a kid, I thought they were funny. As an adult, I realize they were teaching lessons I would eventually use throughout my career. Not because they were showing me how to deceive people, but because they were showing me how people think. That's the part many discussions about social engineering miss. The goal isn't understanding deception. The goal is understanding human behavior. The deception is simply the vehicle.

Forty years after those movies were released, the industry is focused on AI, automation, machine learning, and whatever buzzword will replace them next year.

Meanwhile, the same human tendencies that made Axel Foley, Ferris Bueller, and Fletch successful are still influencing decisions every day.

Technology changes, yes, but human nature doesn't change nearly as fast.

And that's why, despite all the advances in artificial intelligence, some of the best lessons about social engineering can still be found sitting on an old VHS shelf.