Social Engineering & Phishing Testing

Attackers often find it easier to trick a person than to break a system. Our social engineering testing measures how your staff respond to realistic phishing emails, phone calls and in-person pretexts, so you know where training and controls need to improve before a real attacker finds out for you. It is one part of our penetration testing services.

What we test

Phishing simulations

Realistic email campaigns built around pretexts your staff actually see, such as password resets, shared documents, invoices and HR notices.

Click, credential submission and reporting rates by department
Look-alike domains and landing pages, built and hosted for the test
Whether your email security and reporting process catch the campaign

Vishing (voice phishing)

Phone calls to your help desk and staff impersonating employees, vendors or IT support, testing identity verification procedures such as password and MFA resets.

Physical social engineering

Attempts to enter offices, data centers or restricted areas through tailgating, impersonation or badge weaknesses, carried out only with written authorization and agreed safety rules.

Targeted attacks on high-risk roles

Carefully scoped tests of executives, finance and IT administrators, the roles attackers target for wire fraud and business email compromise.

How Our Social Engineering & Phishing Testing Works

Scoping & Rules of Engagement

We agree on targets, pretexts, timing and what is off limits, and who in your organization knows about the test, documented in a Statement of Work and authorization letter.

Reconnaissance

We research what an attacker could learn about your organization from public sources, such as email formats, staff roles, vendors and social media, and use it to build believable pretexts.

Campaign Execution

We run the agreed email, phone or physical scenarios, track every interaction and stop immediately if anything puts people or operations at risk.

Reporting

You receive results by department and scenario, examples of what worked and why, and recommendations for training, technical controls and verification procedures. Individuals are not publicly named.

Training & Retesting

We help you turn the results into targeted awareness training and repeat the exercise later to measure improvement.

Know Your Risk Before Attackers Do

Schedule a scoping call with our penetration testing team. We will define the right engagement for your environment, compliance requirements, and budget, and deliver findings that drive real security improvement.

Schedule Your Free Penetration Testing Scoping Call

Frequently Asked Questions

Do employees get in trouble if they click?

They should not. The goal is to measure and improve your organization's defenses, not to punish individuals. We report results by department and scenario and recommend you use them for training.

Do you use our real branding and vendors in phishing emails?

Only with your approval. Pretexts and any impersonated brands, vendors or internal senders are agreed in the rules of engagement before the campaign starts.

How often should we run phishing tests?

Most organizations benefit from testing at least once or twice a year, and after major changes such as a merger or a new email platform, so they can see whether training is working.

Is social engineering testing part of a penetration test?

It can be. Many organizations add a phishing campaign to an external network penetration test to see whether a successful phish could lead to deeper access, and some frameworks and cyber insurers ask for evidence of phishing testing.

How much does social engineering testing cost?

Pricing depends on the number of people, scenarios and whether phone or physical testing is included. We provide a fixed quote after a free scoping call.