Social Engineering Penetration Testing

Phishing (email): We run targeted email campaigns to test whether your team can spot and report a convincing attack, and how far a click could take an attacker.

Spear phishing and whaling: We craft tailored attacks aimed at specific individuals, including senior leaders and finance teams, the high-value targets attackers research and pursue.

Vishing (voice): We test how your team responds to phone-based manipulation, where an attacker uses a convincing pretext to extract information or access.

Smishing (SMS): We assess susceptibility to text-based attacks, an increasingly common route that often bypasses email defences entirely.

Pretexting and impersonation: We pose as trusted individuals, suppliers, or colleagues to test whether your processes hold up when someone convincingly asks for access or information.

Physical social engineering: Within scope, we test physical defences through tailgating, baiting, and impersonation, assessing whether an attacker could reach your premises, devices, or documents.

Open source intelligence (OSINT): We gather the publicly available information an attacker would use to build these attacks, showing you exactly what your organisation is exposing.

ISO 27001: evidencing the human and awareness controls within your information security programme.

SOC 2: assurance for the security criteria your customers and auditors expect.

PCI DSS: supporting the security awareness requirements that sit alongside technical controls.

Cyber Essentials Plus: reinforcing the people side of your baseline security posture.

GDPR: demonstrating that you take the protection of personal data seriously, including the human factor.

Executive summary: A plain-English overview of the scenarios we ran, how your organisation responded, and what it means for your security culture, written so a non-technical reader can understand your risk position in a couple of minutes.

Scenario breakdown: A clear account of each campaign we ran, the tactics used, and the outcomes, so you can see exactly how your defences held up in realistic conditions.

Response analysis: Insight into how your people and processes reacted, including whether suspicious activity was recognised and reported, and where awareness broke down. Reported at an organisational level, not to single individuals out.

Exposure findings: A summary of the publicly available information an attacker could use against you, and the organisational weaknesses that make manipulation easier.

Practical recommendations: Actionable guidance to strengthen your human defences, from targeted awareness training to process improvements, tailored to the patterns we actually observed.

Debrief and support: The report isn’t the end of the conversation. We walk your team through the findings in a debrief session, answer their questions, and stay on hand as you strengthen your defences.