Testing · Human
Social Engineering & Phishing.
The human perimeter tested the way attackers test it — targeted, plausible and measured, with reporting behaviour treated as the metric that matters.
At a glance
- Surface
- Human
- Execution
- Manual, senior-led
- Retest
- Included, no charge
- Proposal
- Within one business day
Scope
Measure behaviour, not blame.
Campaigns are designed with your people team, run under strict ethical rules, and reported at the population level rather than naming individuals.
Targeted phishing campaigns
Pretexts built from real OSINT on your organisation, tracked for click, credential and report rates.
2–3 weeks
Spear phishing & whaling
Executive and finance-focused campaigns modelling business email compromise.
1–2 weeks
Vishing & smishing
Voice and SMS pretexting against help desks, finance teams and remote staff.
1–2 weeks
Physical intrusion testing
Tailgating, badge cloning and on-site pretexting against offices and data centres.
3–5 days
MFA bypass & AiTM simulation
Adversary-in-the-middle phishing that tests whether your MFA actually resists it.
1–2 weeks
Awareness uplift
Debrief sessions and tailored guidance built from what your people actually fell for.
1 week
Method
Ethical by design.
Nothing starts before the authorisation letter is signed and the blast radius is agreed.
- 01
Rules of engagement
Scope, exclusions, ethical boundaries and legal authorisation agreed in writing.
- 02
Reconnaissance
OSINT on people, suppliers, technology and public exposure.
- 03
Pretext design
Plausible scenarios and infrastructure built and reviewed before launch.
- 04
Execution
Controlled campaigns with live monitoring and immediate stop conditions.
- 05
Debrief
Aggregate metrics, control gaps and awareness uplift — never individual shaming.
Deliverables
What lands on your desk.
- Campaign results with click, credential, report and dwell metrics
- OSINT exposure report on your people and brand
- Technical control gaps in mail, MFA and endpoint defences
- Physical security findings with photographic evidence
- Aggregate, non-attributable reporting for staff communication
- Awareness uplift recommendations and debrief materials
- Repeat baseline campaign to measure improvement
Indicative timeline
Kickoff to closure.
- Week 0
- Rules of engagement, exclusions and authorisation
- Week 1
- OSINT, pretext design and infrastructure setup
- Weeks 2–3
- Campaign execution with live monitoring
- Week 4
- Reporting, debrief and awareness session
- Month 3+
- Optional repeat campaign to measure uplift
Enquire
Start a Social Engineering & Phishing conversation.
Tell us what you need tested. A senior consultant replies within one business day with scoping questions and indicative timelines — no sales funnel.
PRACTICE 06 OF 07
Start here
Test the human perimeter before someone else does.
Tell us who the likely targets are. We'll design an ethical campaign and respond within one business day.