Social Engineering
& Phishing Testing
Test how people and processes respond to impersonation and deception. Use the findings to improve training and everyday checks.
Overview
Most breaches start with a person.
We design scenarios tailored to your organisation — spear phishing, vishing, pretexting, and USB drops — execute the campaign, and deliver detailed metrics on click, submission, and reporting rates, with a debrief and awareness recommendations.
Coverage
What we test.
Multi-channel social engineering tailored to the threats your people actually face.
- Spear phishing campaigns
- Voice phishing (vishing)
- SMS-based attacks (smishing)
- Pretexting scenarios
- Payload & credential-capture pages
- USB drop tests
- Click, submission & report metrics
- Awareness debrief & recommendations
FAQ
Social engineering testing FAQ
Scope, cost, and what happens next.
How much does a social engineering or phishing test cost?
A social engineering engagement typically costs €2,000–4,000 depending on scenarios, channels, and headcount. Ongoing managed phishing is priced separately. Use our estimator for a tailored figure.
Is social engineering testing safe and legal?
Yes — all testing is authorised in writing, scoped carefully, and designed to measure and educate, never to harm or embarrass staff.
What do you measure?
Open, click, and credential-submission rates, plus the all-important reporting rate — how many people recognised and reported the attempt — tracked over time.
How is this different from awareness training?
Social engineering testing measures real behaviour under simulated attack; awareness training builds the skills. They work best together.
Will staff know it is a test?
Not in advance — that would defeat the purpose. Afterwards we run a constructive debrief and just-in-time coaching for anyone who engaged.
How do you choose the scenarios?
We tailor them to your sector, tooling, and current threats — and agree every scenario with your point of contact before launch.
More questions about this service
Do you need employee details?
A target list of email addresses and/or phone numbers, handled strictly under NDA and deleted after the engagement.
How do you protect staff during testing?
Scenarios are designed to educate, not humiliate; results are reported in aggregate and individuals are coached, not penalised.
Can you target specific high-risk teams?
Yes — finance, executives, and IT are common focus groups for pretexting and spear-phishing scenarios.
How does this complement a phishing programme?
A point-in-time test measures current resilience; an ongoing managed awareness programme then drives sustained improvement.
Related services
Explore more.
Ready to test your people?
A 30-minute scoping call costs nothing. One successful phish costs considerably more.
Book a short call Send an email