Social-engineering testing evaluates whether attackers could influence employees, help desks, suppliers or physical controls to disclose information, approve actions or grant access. The service is for organisations that need controlled evidence of human and process vulnerabilities, not merely completion statistics from awareness training.
The purpose is to validate realistic attack paths safely and convert technical weaknesses into remediation priorities.
Scope is fixed with you before any work starts. Depending on the objective, environment and authorised access, the engagement may cover:
Agree target groups, excluded individuals, data collection, safe payloads, stop conditions and communications.
Create pretexts and scenarios relevant to the organisation’s roles, suppliers and business processes.
Use controlled infrastructure and prevent unnecessary collection of sensitive information.
Measure action, reporting, verification and escalation rather than relying on click rate alone.
Provide targeted recommendations, coaching and retest options.
Everything we hand over speaks to both leadership and the people who will act on it. Depending on scope, they may include:
Testing is governed by written authorisation, explicit exclusions, safety limits and emergency contacts. Material findings are manually validated, supported with reproducible evidence and explained in terms of realistic impact rather than scanner severity alone.
The engagement may draw on NIST security-awareness guidance, recognised social-engineering testing ethics, applicable privacy and employment requirements. Referencing a framework describes how we structure the work; it is not, in itself, a certification, accreditation or regulatory ruling.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
Testing must be proportionate, authorised and privacy-conscious. It should not humiliate employees, collect unnecessary credentials or create unsafe operational consequences. Routine training simulations and adversarial social-engineering assessments must remain clearly distinguished.
Discuss Social-Engineering Testing with us. A short scoping session confirms the objective, boundaries, evidence, delivery model and outputs before we issue a proposal.
Scope is fixed with you before any work starts. Typical areas include email phishing and targeted spear-phishing scenarios, Telephone vishing and help-desk verification tests, SMS or collaboration-platform scenarios where approved, and Physical entry, tailgating or pretexting where expressly authorised. Exclusions, required access, your responsibilities and acceptance criteria are all set out in the proposal and SoW.
Deliverables depend on the agreed objective and may include scenario plan and authorisation record, Results by scenario, role and organisational unit, Process-control and verification observations, and Privacy-aware metrics and limitations. Every significant finding is tied to evidence, business impact, priority and a clear owner for the next step.
Authorised testing can create risk if it is poorly controlled. Cyber Tech Group agrees testing windows, prohibited techniques, stop conditions and emergency contacts before work begins, and uses higher-risk techniques only with explicit approval.
Retesting can be included in the initial scope or ordered after remediation. It validates the previously confirmed findings and closely related bypass conditions; it is not automatically a complete new assessment.
Timelines are set once scope is agreed, and vary with the size of the environment and the availability of evidence and stakeholders.
These services answer related but distinct questions. Scoping identifies whether Social-Engineering Testing, Phishing Simulations, or a coordinated programme is the smallest useful approach without duplicating work.
Testing must be proportionate, authorised and privacy-conscious. It should not humiliate employees, collect unnecessary credentials or create unsafe operational consequences. Routine training simulations and adversarial social-engineering assessments must remain clearly distinguished.
