Social Engineering
Starts at $3,600, fixed scope. See all pricing →
Reply in one business day
Thanks, we've received your message.
We'll be in touch shortly.
When you need it
The situations that bring teams to this engagement, and where it fits alongside the rest of your program.
Definition
Social engineering penetration testing measures whether your people can be talked into giving an attacker access. It goes beyond a single phishing email to voice (vishing), SMS (smishing), and pretexting, and reports who clicked, who submitted credentials, and who raised the alarm.
Phishing simulation
Social engineering test
Red team
When the human layer is one leg of a covert, full-chain operation toward an agreed objective, the engagement is a red team.
What we look for
Your strongest technical controls can be bypassed by one convincing message. We measure how your workforce responds to realistic social engineering across email, voice, and SMS.
Realistic lures that measure who clicks, who submits credentials, and who reports.
We test for
Voice and SMS pretexting that tests staff away from the inbox.
We test for
How well people recognize, resist, and report an attack in progress.
We test for
Whether your email defenses stop the message before it lands.
We test for
The scenarios that go beyond a link in an email: a convincing story, a person at the door, or a login page that steals the session after MFA.
We test for
Metrics
A campaign is only useful if the numbers mean something. Every result is broken down by department and role, and benchmarked against your previous campaigns when you have them.
What it tells you
Design
Generic phishing templates measure how well people spot generic phishing. Real attackers research first, so we do too: public job postings, vendor relationships, executive names, seasonal events, and the tools your staff use every day all shape the pretext. The campaign in our higher-education case study used a seasonal pretext and a look-alike single-sign-on domain, and captured credentials from senior staff for exactly that reason.
Every campaign runs under written rules of engagement agreed with you: who is in scope, what the capture page does with anything entered, how long the campaign runs, and who inside your organization knows. Captured credentials are never stored in plaintext, results are reported by department rather than by name unless you ask otherwise, and the objective is measurement and improvement, not blame.
After the campaign
Methodology
Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.
These are the phases your phishing simulation & social engineering testing runs through.
Public footprint researched and scenarios built around how your organization really works.
Lures, domains, capture pages, and safety controls prepared and approved with you.
Email, voice, or SMS campaigns run discreetly under agreed rules of engagement.
Opens, clicks, submissions, reports, and time-to-report captured by department.
Results turned into targeted awareness recommendations and a repeat cadence.
How it works
From scope through the final report, your team stays in the loop at every step, with findings tracked live in our platform.
Scope & kickoff
Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.
Testing goes live
Findings post to your live platform dashboard the moment our testers confirm them.
Track remediation
Follow every finding from open to fixed, with severity, evidence, and status in one place.
Report & debrief
Executive and technical reports land, with clear results and a prioritized remediation plan.
Compliance
Findings are mapped to the requirement or control they evidence, so the same report serves your auditor, your customers, and your engineers.
Proof
Every engagement is confidential, so the work below is anonymized to sector and engagement type.
12,000+
Employees phishing-tested
53%
Phish-prone in one healthcare campaign
2-channel
Email plus voice campaigns run
Fixed
Scope and price, no hourly billing
Healthcare · Imaging
Organization-Wide Phishing Simulation
Over half the workforce took the bait: roughly a third clicked the link and a quarter entered their credentials on the simulated capture page.
Outcome. Quantified credential-compromise risk across the whole organization and delivered a prioritized program of role-targeted awareness training, recurring simulations, and a faster, simpler reporting workflow.
11,800+
Employees targeted
53%
Phish-prone
24%
Entered credentials
Higher Education
Credential-Harvesting Phishing
Using a seasonal pretext, an SSO look-alike domain, and abuse of a legitimate mail-platform send feature, the campaign reached inboxes and captured SSO credentials.
Outcome. Demonstrated a credible path to SSO account takeover and drove improvements to email authentication, look-alike domain monitoring, password policy, and targeted training.
100+
Staff targeted
20%
Credentials captured
Exec
Accounts affected
Resources
Spear Phishing: Targeted Attacks and How to Defend
What spear phishing is, how it differs from ordinary phishing, the real techniques attackers use against named employees, and how testing and controls stop it.
Vishing: Voice Phishing Attacks and How to Defend
What vishing is, how attackers use phone calls and AI voice cloning to bypass technical defenses, and how to defend against it.
Evilginx: Phishing That Bypasses MFA
Evilginx explained: how adversary-in-the-middle phishing steals session tokens to get past MFA, how to detect it, and why passkeys and FIDO2 stop it.
Want to see a report first?
Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.
FAQ
What teams most often ask before scoping
phishing simulation & social engineering testing.
A phishing simulation, sometimes called an employee phishing test, is a controlled campaign that sends realistic but harmless phishing emails to your workforce to measure who clicks, who submits credentials, and who reports the attempt. Every click is captured safely and turned into metrics you can act on. It is the fastest way to baseline your human attack surface and to satisfy the security awareness expectations in frameworks like SOC 2 and ISO 27001.
A social engineering penetration test is a controlled attack on your people rather than your systems. Testers research your organization, then run email phishing and, where scoped, voice and SMS campaigns and pretexting, to see who can be persuaded to click, hand over a credential, or approve an MFA prompt. The report breaks the results down by department and turns them into targeted awareness recommendations. When a framework or customer asks for social engineering testing services, this is the engagement that answers it.
It measures how your workforce responds to realistic social engineering, including who clicks, who submits credentials, and who reports the attempt, then turns those results into targeted awareness improvements.
Yes. Alongside email campaigns we can run voice (vishing) and SMS (smishing) scenarios for a fuller picture of your social engineering risk.
No. Campaigns are run discreetly so results reflect real behavior, with your authorization and clear rules of engagement agreed in advance. The goal is measurement and improvement, not blame.
A standard campaign covers your full workforce or a defined set of departments; we size the lures and reporting to your headcount. Very large or multi-region organizations are scoped so results stay meaningful by team rather than a single blended number.
Most organizations run phishing testing quarterly or twice a year so awareness stays current and you can measure improvement over time. A single baseline campaign is a good starting point, and many teams then move to a recurring cadence.
A phishing campaign starts at $3,600, fixed before work begins. It is often the easiest first engagement and a natural lead-in to internal network testing or a full red team. Starting prices for every service are on our pricing page.
Yes. Attackers do, so the test should too. Adversary-in-the-middle phishing kits proxy the real login page, relay the MFA prompt, and capture the authenticated session, which defeats SMS codes and push approvals. We run the same technique in a controlled way, which shows whether your MFA method actually resists phishing and whether your conditional access and session controls catch the stolen session. Our Evilginx explainer describes how the technique works.
We provide the results, the analysis, and a targeted training plan: which departments and roles need attention, which pretexts worked, and what the reporting workflow should look like. Many clients run the training through their existing platform and use our follow-up campaigns to measure whether it worked. Where you do not have a platform, we advise on options during the debrief.
Ask four things. Who designs the pretexts: a template library, or people who research your organization first? Can they run adversary-in-the-middle phishing that defeats MFA, since that is what real attackers use now? Are results reported by department with time-to-first-report, or as a single click rate? And is the price fixed before the campaign starts? Ours is $3,600 for a scoped campaign, and the case study on our case studies page shows what a campaign across a large healthcare workforce produced. One more distinction: managed campaigns, where we design and run the operation and interpret the results, versus self-serve phishing simulation software your team operates. We run managed campaigns, so the pretexts are researched and the results come back with analysis rather than a raw dashboard.
Talk to our team about scoping phishing simulation & social engineering testing.
Prefer the full scoping questionnaire?Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.
