Cybersecurity
Social engineering assessments
Many intrusions begin with a believable message or call. We test that path with permission, and report on what your controls and processes did, not on who clicked.
The problem this service solves
Phishing and pretexting work because they use ordinary business behavior: urgent requests, familiar vendors, a help desk call. Training helps, but training alone does not stop a determined attacker. Controls help more: strong authentication, mail filtering, reporting paths, and help-desk verification procedures.
This assessment measures how those layers perform together. A good result is not that no one was fooled. It is that fooled users were stopped by a control, or that reports reached the security team quickly.
What is in scope
-
Email phishing
Credential capture and attachment-style scenarios aimed at defined groups, using lookalike content created for the test.
-
Voice (vishing)
Calls to help desks, finance or other teams to test verification procedures.
-
Process bypass
Requests that try to exploit weak approval steps, such as a payment change or an access request.
-
Reporting path
Measure how many recipients report the message, how fast, and what the security team does next.
-
Control performance
Mail filtering, link and attachment handling, multi-factor authentication and conditional access responses.
How the work runs
Plan
Set rules and pretexts.
-
1
Authorization and ethics
Agree what is allowed, what is not, and how participants are treated.
-
2
Pretext design
Create scenarios relevant to your business, avoiding topics that cause harm, such as pay, benefits or health.
Run
Execute in a controlled window.
-
3
Delivery and monitoring
Send, call and observe. Pause at any sign of real harm.
-
4
Capture evidence
Record outcomes at group level, with credentials handled according to the agreed procedure.
Report
Fix the system, not the person.
-
5
Aggregate results
Rates of reporting, clicking and credential entry by group, not by name.
-
6
Control analysis
Which layers stopped the attack, which did not, and what to change.
What you receive
- Executive summary with aggregate results
- Control and process analysis
- Recommendations for filtering, authentication and verification procedures
- Suggestions for targeted training based on observed patterns
- Reporting-path timing
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Written authorization from leadership, and alignment with HR and legal
- An agreed scope of staff, groups and channels
- A safe-word or deconfliction route for the security team
- Mail allowlisting details where the test requires it
What this service is not
- Individual performance evaluation
- Targeting employees’ personal accounts or private lives
- Anything not approved by the right authority at your organization
What changes afterwards
- Help-desk and finance procedures are tested, not only documented
- Reporting channels are shown to work
- Training is aimed where it will help
Questions people ask
Will you name employees who fall for the test?
No. Results are reported in aggregate. Our aim is to improve controls and processes, not to embarrass people.
Do you test with real credentials?
We capture only what is needed to prove the point, handle it under an agreed procedure, and recommend password resets afterward.
Related
-
Red teaming
Objective-based adversary simulation that tests people, process and technology together against a realistic attacker over several weeks.
-
Microsoft Entra security
Review Conditional Access, privileged roles, application consent, authentication methods, sync and monitoring in Microsoft Entra ID.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response