A transit SE exercise uses an approved script where a caller claims rail control needs VPN access immediately. Which psychological levers are most clearly in play?

A transit SE exercise using an approved script where a caller claims rail control needs VPN access immediately primarily exercises authority and urgency under an authorized municipal testing script. Authority frames the caller as someone staff should obey; urgency compresses verification time. Together they pressure helpers to bypass normal identity checks—exactly the psychology ROE-approved SE drills measure so transit can harden verification habits.

Framing the scenario as only technical CVE chaining with no human influence factors misses that the attack is social, not vulnerability exploitation. Calling it only random chance unrelated to social psychology denies the deliberate leverage design. Describing it as only physical lock picking with no verbal pretext invents a different attack class than the phone script described.

Exam caveat: recognize influence principles (authority, urgency, scarcity, liking, etc.) in approved scripts without treating psychology content as permission to run unauthorized tests.

Operational check: document which levers the script uses, train staff on verification steps that resist authority-plus-urgency (out-of-band call-back to known numbers), and score the exercise on verification compliance rather than on whether VPN credentials were verbally discussed.