Social engineering and phishing exercises reduce the risk from adversaries who bypass technical safeguards by targeting people instead of systems. They show how your staff respond to realistic phishing, smishing and vishing, and whether your controls and awareness programmes work as expected.
years testing for government and enterprise
CREST-accredited through CREST ANZ
We design tailored campaigns that reflect current attacker techniques, including phishing that bypasses MFA.
We measure real behaviour (link clicks, credential submission, reporting rates and authentication failures) and give you guidance to improve training, processes and controls.
Attackers target broad groups or specific people and try to trick them into revealing information, granting access, approving transactions or taking an action that benefits the attacker. A social engineering test reminds users of their role in protecting the organisation and checks controls such as security awareness training and incident reporting.
Social engineering is the modern word for an old concept: a con.
who opened the message
who clicked or submitted information
who reported it, and how
who exposed MFA credentials or sessions
Tests also support ISO/IEC 27001, PCI DSS and the Australian Government Information Security Manual by showing that staff awareness and response are monitored and improved.
A clear, evidence-based view of how resilient your people are, and what to improve next.
Phishing is the example here; smishing, vishing and other tests follow the same process with different delivery. We handle the technical and content side. You provide a little help so the test lands properly and gives meaningful results.
A short scoping session covers your environment, training goals and users. We align content with any existing awareness training, review your MFA setup to see what an attacker would need to bypass it, and agree templates with you in advance, such as HR announcements, supplier messages or look-alike login pages.
Together we allow the emails through your gateway and spam filters (or, for more realism at more cost, work to bypass them), stop security tools clicking the links first, and test delivery to a small group. This usually takes a few hours of your time over a day or two.
Run the test across the whole organisation at once or over several days, quietly or alongside internal communications. We capture who opened, clicked, submitted, reported, and exposed MFA credentials.
A clear report summarises results, trends and next steps, followed by meetings to walk through the findings and decide on actions. They are run by the assessors who designed and analysed your test, not a sales or account manager.
A controlled exercise in which we try to trick staff into revealing information, granting access or taking an action, the way a real attacker would. It shows how people respond and whether controls such as awareness training and incident reporting work.
Phishing, including phishing that bypasses MFA through adversary-in-the-middle login pages and push-notification fatigue, plus credential-harvesting portals, smishing (SMS) and vishing (voice). The process is the same for each; only the delivery changes.
A short scoping session, agreement on the templates, and help allowing the test emails through your gateway and filters and stopping security tools from clicking links first. That normally takes a few hours of your time, spread over a day or two.
A report, usually a PDF, showing who opened, clicked, submitted information, reported the message and exposed MFA credentials, with trends and recommended next steps, then follow-up meetings with the assessors who ran your test.
A bad day phishing is better than a good day in the office. Let’s see whether users click a suspicious link, then go further with phishing that bypasses multi-factor authentication.
We use techniques seen in real incidents, such as fake login portals that harvest session cookies and push-notification fatigue attacks. Let’s go phishing.
