What we look for
Social engineering tactics we test
People are the most targeted part of any organization. We measure how your workforce responds to realistic social engineering across email, voice, and SMS.
Email Phishing
Realistic lures that measure who clicks, who submits credentials, and who reports.
We test for
- Pretext and lure design
- Credential-harvesting pages
- Attachment and link payloads
- Departmental targeting
Vishing & Smishing
Voice and SMS pretexting that tests staff away from the inbox.
We test for
- Phone pretexting scenarios
- SMS lure campaigns
- Help-desk and reset abuse
- MFA fatigue and prompt bombing
Awareness & Reporting
How well people recognize, resist, and report an attack in progress.
We test for
- Report-rate measurement
- Repeat-clicker analysis
- Time-to-report tracking
- Reporting workflow review
Technical Controls
Whether your email defenses stop the message before it lands.
We test for
- SPF, DKIM, and DMARC review
- Gateway and filter bypass
- Spoofing and lookalike domains
- Link and attachment handling
How it works
How your engagement runs
From scope through the final retest, your team stays in the loop at every step,
with findings tracked live in our platform.
- 01
Scope & kickoff
Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.
- 02
Testing goes live
Findings post to your live platform dashboard the moment our testers confirm them.
- 03
Track remediation
Follow every finding from open to fixed, with severity, evidence, and status in one place.
- 04
Report & retest
Executive and technical reports land, then request a free retest in one click.
Resources
Field notes from the offensive side
AWS Penetration Testing: Scope, Rules, and What Gets Tested
How AWS penetration testing works: the shared responsibility model, what you may test without permission, IAM and S3 attack paths, and how to scope an engagement.
AWS Penetration Testing: Rules, Scope, and What to Test
How AWS penetration testing works: what Amazon allows without approval, what's off-limits, the misconfigurations that cause real cloud breaches, and how to scope a test.
Black Box vs White Box vs Grey Box Penetration Testing
What black box, white box, and grey box penetration testing each mean, what each finds and misses, what they cost, and how to choose the right method for your goal.
Want to see a real report first?
Request a redacted sample report before you scope an engagement.
FAQ
Frequently asked questions
What teams most often ask before
scoping phishing testing.
01What does phishing testing measure?
It measures how your workforce responds to realistic social engineering, including who clicks, who submits credentials, and who reports the attempt, then turns those results into targeted awareness improvements.
02Do you offer more than email phishing?
Yes. Alongside email campaigns we can run voice (vishing) and SMS (smishing) scenarios for a fuller picture of your social engineering risk.
03Will employees know it is a test?
No. Campaigns are run discreetly so results reflect real behavior, with your authorization and clear rules of engagement agreed in advance. The goal is measurement and improvement, not blame.
Ready to test your defenses?
Talk to our team about scoping phishing testing.
Prefer the full scoping questionnaire?Get a Fixed-Scope Quote
Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.