A social engineering test, such as a controlled phishing campaign, checks how your organisation responds to an agreed deception scenario. It shows what your technical controls stop, what employees notice, whether suspicious activity is reported and whether the information reaches the people who can respond. The aim is not to catch employees out, but to find where the combined defences of people, processes and technology can be improved.
We choose the scenario according to the risk your organisation wants to assess. Before the test, we agree who is in scope, which channels we will use, which actions are prohibited, how data will be handled, how escalation will work and which results will be measured. Not every client needs every scenario.
A controlled email campaign can test more than whether someone clicks. It can test the whole chain of defences. We see whether technical controls stop the message, whether the employee spots the warning signs, whether they use your reporting channel and how quickly the information reaches the team responsible. We do not use open rates as the main security metric, because privacy features and image-loading settings in email clients can skew them significantly.
Where agreed, the scenario can use pretexting by phone or in writing to test your processes for verifying identity and disclosing information. We define in advance what information may be asked for, what must not be collected and the point at which the test must stop immediately.
If the physical security risk is significant and the scenario has been specifically agreed, we can test visitor control, access procedures and how employees respond. Tests of this kind need particularly clear boundaries, authorisations and safety arrangements.
After the test, we analyse what helped to stop the attack and where the chain of defences broke. We base the training on the scenarios tested and show how to recognise the warning signs, how to verify an unusual request and, above all, how to report something suspicious and who to report it to.
We set out in writing the objective, the scenarios, who is in scope, the permitted and prohibited actions, what data is collected and how it is kept, the points of contact, the escalation route and the stop conditions for the test. We do not carry out particularly sensitive actions without separate approval.
We document how the scenario unfolded and record the metrics defined in advance, including delivery, interaction, reporting, escalation and any other events that matter for that test. Before the test, we agree how detailed and how anonymised the results will be, taking the objective and data protection into account.
We do not draw conclusions from the click rate alone. We assess where technical controls, identity verification, employees' actions, reporting channels and incident escalation worked and where they did not, and we prepare a prioritised list of improvements.
After the scenario, we explain the techniques used, the warning signs and the right action to take. The training is built on the conclusions of the test and emphasises how to verify a request safely and how to report it, so that your organisation improves in practice rather than just collecting statistics.
Let's start with a conversation
Tell us which risk you want to test and in what environment. We'll clarify which scenario is suitable, where the boundaries lie, what to measure and what information we need to prepare a proposal.
By its nature, a social engineering scenario uses deception, so its boundaries must be stricter than those of an ordinary training campaign. Before the test, we agree who authorises it, what data is needed, how long it is kept, who has access to the results and what we do if the scenario leads to something unforeseen.
Identifying individual employees is not an end in itself. If the objective of the test can be achieved with aggregated or pseudonymised results, we choose the less intrusive approach. If you need individual-level data, then why it is needed, who can access it and how it will be used must be defined before the test and assessed against your organisation's data protection and employment requirements.
Yes. A controlled phishing campaign is the most common social engineering test. We agree the scenario, target groups and safety conditions with you in advance and assess the results at the level of the organisation, to improve processes and training.