Social Engineering
What this engagement covers
People are the most targeted part of any organization. We run controlled social engineering campaigns — phishing and related techniques — to measure how your team responds, then help you turn the results into practical awareness improvements. Every campaign is agreed in advance and handled carefully.
- Credential-harvesting lures with realistic landing pages
- Malicious attachment and link simulations (as scoped)
- Brand and internal-sender spoofing / pretexts
- MFA-fatigue and consent-phishing scenarios
- Help-desk and password-reset pretext calls
- Targeted role-based pretexts (as scoped)
- SMS phishing (smishing)
- Physical — USB drops and tailgating scenarios
- Click, submit and report rates, and time-to-report
- Aggregate reporting only — no naming and shaming of individuals
- a.Targeted phishing campaigns tailored to your organization
- b.Credential-harvesting and payload simulations (as scoped)
- c.Optional pretext calling and other human-layer vectors
- d.Click, submit and report-rate measurement
- e.Careful handling — no naming and shaming of individuals
Scope & rules of engagement
We agree targets, timing, depth and constraints in writing before anything starts — so testing is safe, authorized and focused on what matters to you.
Manual testing
Certified testers work by hand — following recognised methodologies like OWASP and PTES, not just automated scanners — chaining findings the way a real attacker would to prove genuine impact.
Reporting
You get a prioritized report with clear proof-of-concept, business impact and step-by-step remediation your engineers can act on immediately.
Retest
After you fix, we re-test the findings to confirm they are resolved and issue an updated report you can share with customers or auditors.
- →Clear metrics on how your team responded
- →Insight into which lures and pretexts worked
- →Practical, prioritized awareness recommendations
- →A baseline to measure future campaigns against
Yes. Campaigns are agreed with you in advance, scoped carefully, and reported in aggregate — the goal is to improve resilience, never to single people out.
Absolutely. The value is in what happens next — we translate the results into focused, practical awareness guidance for your team.