Social Engineering Testing
Testing the human layer of your defenses directly, phishing, phone-based pretexting, and in-person tailgating.
Who this is for: Businesses that want to test human-layer defenses specifically, beyond a standard phishing simulation.
The Problem
A phishing simulation tests one specific attack channel, email, but real social engineering also happens over the phone (vishing), through fabricated scenarios (pretexting), and in person (tailgating into a building).
Our Solution
We test across multiple social engineering channels, not just email, to see where your human-layer defenses actually hold up and where they don’t.
What's included
- Phishing campaigns (as part of a broader engagement)
- Vishing (phone-based social engineering)
- Pretexting scenarios
- Physical tailgating testing (where in scope)
- Reporting on which channels succeeded and why
This goes beyond what’s covered in our Security Awareness Training service, that’s ongoing training and simulation; this is a point-in-time, multi-channel test of how those defenses actually perform under a realistic, varied attempt. See our write-up on social engineering beyond phishing for the kinds of scenarios involved.
Benefits
- Tested across multiple channels, not just email
- A realistic picture of human-layer risk, not just click rates
- Findings that directly inform where training should focus next
Our Process
Scope
Agree on channels and boundaries (phishing, vishing, physical).
Reconnaissance
Gather the context a real attacker would use.
Execute
Run scenarios across the agreed channels.
Report
Document what succeeded, what didn’t, and why.
Recommend Training
Focus follow-up training on the gaps found.
Proven results: See the social engineering tactics that go beyond a standard phishing email. See the write-up →
Frequently asked questions
Will employees be punished for falling for this?
No, the same principle applies as with phishing simulations, this is about identifying where additional training helps, not punishing individuals.
Does this include trying to physically enter our office?
Physical tailgating testing is available where explicitly agreed to in scope; it’s not included by default.
Especially relevant for
Related services
Penetration Testing
Simulating real-world attacks against your network, web apps, or staff to uncover vulnerabilities before someone else does.
settingsSecurity Configuration
Hardening operating systems, cloud accounts, and applications against CIS/NIST baselines, not just the defaults they shipped with.
monitoringVulnerability Management
Continuous scanning, risk-based prioritization, and patch tracking, so fixes don’t sit in a backlog until an audit finds them.
Not sure if this is the right fit?
Tell us what's worrying you. We'll tell you what actually needs fixing first.