The human factor · email · phone

We test the human factor in your company’s security

An attacker does not always break a system; sometimes they just ask politely. We check how your people respond to an email, a phone call or someone pretending to be someone else.

Phishing and vishingBy departmentTraining afterwards
Request a quote →How we work
What we test

The channels through which access is requested

Each channel is tested only if you include it in the authorization.

Phishing (email)

Simulated messages that test vigilance: from generic ones to those written for a specific person.

Vishing (phone)

Calls in which someone presents themselves as a colleague, supplier or IT support and asks for a password, a code or a payment.

Pretexting and physical access

On request: a credible story at the reception desk or the door, within the limits set in the signed authorization.

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
Which scenarios?
How many employees are in scope?
In how many locations?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How the project unfolds

The scenarios are agreed with you in advance and run only within the window in the signed authorization. The rules are written into the same authorization: who in the company knows about the test, which channels and people are excluded, what we never do (no real payments, no threats), what is recorded from employees’ responses and for how long it is kept, and whom we call straight away if an employee reports a real incident during the campaign.

  1. Scope and quote

    You tell us how many people and which departments are in scope and which kinds of simulated attacks you want; you receive a quote within one business day.

  2. Authorization and scenarios

    You sign the authorization; the scenarios, the list of people and the schedule are agreed with you before the first message.

  3. Preparation

    We write the messages and, where relevant, the landing pages, in your company’s language and style.

  4. The campaign

    We send within the agreed window and track who opens, who clicks, who enters data — and who reports the message to the security team.

  5. Report and training

    You receive the results per campaign and per department and, on request, training for employees built on examples from the campaign.

What you receive

Deliverables

  • Results per channel and per department: how many responded, gave information or reported — by name or aggregated only, as the authorization sets out
  • The scenarios used and the signs by which they could be recognised
  • Process recommendations: verifying payment requests, password resets, receiving visitors
  • On request, training after the test, on real examples from the campaign
Further reading

Guides related to this service

Moldova cybersecurity law guideDORA and TLPT guideISO 27001 and SOC 2 guideNIS2 and GDPR guide
FAQ

What clients ask us

How long does a social engineering test take?
Usually 2–3 weeks from signing the authorization to the report; in urgent mode, 5–7 days.
Does it matter whether employees have been trained before?
Yes: we choose the scenarios accordingly. Where there was training, the test shows whether anything stuck; where there was none, it shows where to start.
What happens to the data employees enter?
It is set out in the authorization, before the campaign: what the test page records, how long the results are kept and whether the report names employees or shows departments only. If a real password was entered, we recommend changing it after the campaign.
Who in the company needs to know about the test?
Only a few people, named in the authorization: usually management and the security officer. They can stop the test at any time and, when needed, confirm that a suspicious message is part of the campaign.
Do you work with small companies?
Yes: with start-ups, SMEs and corporations. The quote starts from your scope, so a small project stays small.

Want to know how your team would respond to a polite attacker?

Describe the scope; we reply with a quote within one business day.

Request a quote →