Social Engineering & Phishing Assessment

The generic “your mailbox is full” template teaches employees nothing, because a real attacker wouldn’t send it. We research your organisation first, build pretexts around genuine context, a plausible supplier, a current project, an internal system by name, and craft emails good enough to fool people who “know better”. A test that’s easy to spot flatters your numbers and protects no one.

The aim is data, not a naming-and-shaming exercise. We measure who opened, who clicked, who entered credentials and, crucially, who reported it and how fast. That reporting rate matters as much as the click rate, because an organisation where the third recipient raises the alarm is in a very different position from one where nobody does.

We build an open-source intelligence picture of your organisation the way an attacker would: employee names and roles from LinkedIn, email formats, technologies you mention publicly, suppliers, and any credentials already exposed in past breaches. From that we design pretexts that fit your world, because relevance is what makes people click.

We register look-alike domains, configure sending infrastructure to pass basic email authentication where realistic, and launch in controlled waves so we don’t overwhelm your mail systems or your helpdesk. Landing pages mirror your real login experience closely enough to be convincing, and every interaction is logged with a timestamp.

MFA is not a magic shield

Many clients assume multi-factor authentication makes phishing irrelevant. It doesn’t. Real-time relay pages capture the second factor as the user enters it, and MFA-fatigue attacks simply push prompts until a tired employee taps “approve”. Where you allow it, we demonstrate these safely so you see that MFA raises the bar without closing the door.

Where the scope includes it, we call. A confident voice claiming to be from IT, a supplier chasing an invoice, or a new starter locked out of an account can extract more than any email. Helpdesks that reset passwords or MFA on the strength of a name and a plausible story are a common and serious finding.

When the campaign closes we analyse the numbers and the narrative: click and submission rates by department, time-to-report, which pretexts worked and why, and what an attacker would have achieved with the credentials captured. Then we brief you, and we keep the tone constructive so the outcome is a stronger workforce, not a frightened one.

The wide net: a plausible message sent to much of the workforce to measure baseline susceptibility and reporting. It answers the simplest and most important question, what proportion of your staff click and enter credentials on a decent lure, and gives you a number to improve against.

Here we go narrow and deep, targeting a handful of high-value people such as finance approvers, executives and system administrators with heavily researched, personalised messages. These are the attacks that lead to real money moving or privileged access being handed over, so a single success here matters far more than a dozen bulk clicks.

We simulate the invoice-redirection and payment-request fraud that costs European businesses more than almost any other cybercrime. The test probes your payment-approval process directly: whether a convincing email really can move funds without an out-of-band check, and where that process needs a hard stop.

Modern attackers don’t send cold emails, they inject into existing conversations, replying within a real thread from a look-alike address so the message inherits the trust of everything above it. We reproduce this to test whether your people spot the switch when the context looks entirely genuine.

An email that appears to come from the CEO demanding an urgent payment bypasses careful thought, because questioning authority under time pressure feels risky. Business email compromise built on this single lever costs European companies enormous sums every year, and it needs no malware at all.

A message referencing a real project, a genuine supplier or a system your staff use daily lowers everyone’s guard. The more an attacker knows about you, and open sources reveal a great deal, the more convincing the lure and the higher the click rate.

The service desk exists to be helpful and unblock people quickly, which makes it a prime target. Without strict identity verification, a caller with a name and a story can get a password reset or an MFA re-enrolment, and that single act can hand over an account.

Click rate, submission rate, report rate and time-to-report, broken down by department and role, with a plain-language summary for leadership on what an attacker would have achieved and how you compare to where you should be.

The pretexts used, the infrastructure, screenshots of landing pages, and a step-by-step account of what captured credentials would have opened up, tied to real impact rather than abstract risk.

Specific, prioritized recommendations covering training, technical controls such as email authentication and phishing-resistant MFA, and helpdesk process. A follow-up campaign later measures whether the changes moved the numbers, which is the only proof that matters.

We walk your team through the campaign in a working session: which lures landed, why they worked, and what a defender should have seen at each stage. Many of the most useful fixes come out of this conversation, from tightening an email rule to rewriting the helpdesk’s identity-verification script, and it turns a set of raw numbers into a concrete, funded plan the team genuinely owns.

ISO 27001 Annex A control 6.3 covers information-security awareness, education and training, and auditors like to see it tested rather than merely delivered. SOC 2 expects evidence that awareness controls work, and PCI DSS 4.0 requirement 12.6 mandates a security-awareness programme that phishing simulation directly supports.

For regulated entities, DORA and NIS2 both emphasise the human element of resilience and staff awareness. A documented, repeated social engineering programme is strong evidence that you take it seriously and measure it.