Social engineering & phishing simulation
People are the most targeted attack surface, and most breaches start with someone being persuaded to click, call back or hand over a code. We run authorised phishing, spear-phishing, vishing and smishing campaigns to measure that human risk, and to check whether your detection and reporting actually work. It is a learning exercise meant to build resilience, not to catch people out.
The human attack surface
Social engineering targets people through the channels attackers actually use. Like a real attacker, we use OSINT to design realistic, authorised scenarios across email, voice and SMS. We measure both how susceptible people are and how well your detection and response process holds up.
- Phishing: broad, realistic email campaigns measuring click and submit rates
- Spear-phishing: targeted, OSINT-informed lures against named roles
- Vishing: voice-pretext calls (e.g. help-desk and MFA-reset scenarios)
- Smishing: SMS-based pretexts and malicious-link delivery
- Payload and landing-page realism (credential capture, attachment, MFA-prompt)
- Detection and reporting: did the controls and the people respond?
Realistic, authorised, ATT&CK-mapped
Every campaign is explicitly authorised and run within agreed rules of engagement. We use OSINT to design believable pretexts and map techniques to the MITRE ATT&CK Initial Access and Reconnaissance tactics. The goal is learning: we report on patterns and process to improve awareness and response, and never single out individuals.
- 1
Scoping & authorisation
We agree objectives, channels, target groups and rules of engagement, with explicit written authorisation and an NDA.
- 2
OSINT & pretext design
We gather open-source intelligence and design believable, in-scope scenarios for each channel.
- 3
Campaign execution
We run the phishing, vishing and smishing campaigns within the agreed window and rules.
- 4
Response measurement
We measure susceptibility and whether detection, blocking and user reporting actually fired.
- 5
Reporting & awareness
We deliver aggregate results and recommendations framed for awareness and process improvement.
What you receive
An aggregate picture of human risk and response, with the data and recommendations to improve training and detection. It is written to build resilience, not to assign blame.
- Executive summary of human risk and response posture
- Aggregate campaign metrics: click, submit and report rates per channel
- Detection and reporting results: did controls and people respond?
- Techniques mapped to MITRE ATT&CK (Initial Access, Reconnaissance)
- Prioritised recommendations for awareness training and controls
- Aggregate, non-punitive reporting (no individual blame)
Grounded in MITRE ATT&CK & authorised testing
Campaigns map to MITRE ATT&CK (Initial Access and Reconnaissance tactics) and run only under explicit written authorisation and agreed rules of engagement. Social engineering is a learning exercise: results are reported in aggregate to improve awareness, controls and response, never to single out individuals. Scenarios are designed with OSINT to be realistic while staying strictly in scope.