Social engineering testing
Realistic phishing and phone-pretext simulations that measure how likely your people are to be tricked, and what to do about it.
When you need it
- You want evidence your awareness training works
- An insurer or auditor asks for phishing metrics
- After a phishing incident
- ISO 27001 awareness controls
What we test
Most real attacks start with a convincing email or call. We run agreed, realistic scenarios against your staff and report what worked, without naming and shaming individuals.
Tailored emails and landing pages that measure opens, clicks and credential submissions.
Calls to agreed staff groups testing help-desk and finance processes.
How quickly staff report suspicious messages, and how your team responds.
Targeted training and process changes based on what actually worked.
How the test runs
- Scenario agreement. Pretexts, target groups and excluded people are agreed in writing first.
- Campaign. Usually two to four days of preparation and delivery, timed to suit you.
- Ethics. No threats, no impersonating police or regulators, and no storing real passwords beyond proof of submission.
- Report and debrief. Clear metrics for leadership, lessons for staff, and an optional follow-up campaign.
Supports
- ISO 27001
- Cyber insurance
- Security awareness programmes
Questions
Will staff be named in the report?
Not by default. We report by team or role so the focus stays on improving processes, not blaming people.
Can you include phone calls?
Yes. Pretext calls to agreed groups, such as the help desk or finance, are often more revealing than email.
Is this legal?
Yes, with your written authorisation and agreed scenarios. We follow strict ethical rules set out in the rules of engagement.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.