Services

Social Engineering Testing

Every technical control you've bought assumes a human being will do the right thing at the right moment. Social engineering testing is how you find out whether that assumption holds — before someone with bad intentions finds out for you.

I run these engagements the way an actual adversary would plan them: a pretext built from what's publicly findable about your organization, a believable ask, and a path that leads somewhere real — a badge-in at a door, a password reset over the phone, a link that drops a payload. Phishing gets most of the attention, but vishing (phone pretexting), physical tailgating, and USB drops all belong in the same conversation, because a determined attacker won't limit themselves to email either.

What I'm actually testing

Not "did someone click." That metric tells you almost nothing on its own. I'm testing whether your detection and response processes notice the attempt, whether the person who got fooled knew what to do next, and whether one compromised credential or one propped-open door turns into a much bigger problem. The report I hand back maps specific gaps — in training, in process, in physical controls — to specific fixes, not a generic "raise awareness" recommendation.

Where this fits

If you've never run a social engineering test, start small and scoped — a single pretext against a single team, so the organization doesn't feel ambushed and you get a clean read on one risk at a time. If you've got a mature program already, I can design harder, multi-stage scenarios that chain a phone call into a physical visit into a network foothold, which is closer to how a real intrusion actually unfolds.

Either way, the point isn't to catch people out. It's to find out, in a controlled way, what happens when someone tries — and to fix that before it happens for real.

If you want to talk through what a scoped engagement would look like for your organization, get in touch.