Home / Penetration Testing / Social Engineering

Social Engineering
& Phishing Testing

Realistic simulated phishing, vishing, and pretexting campaigns tailored to your organisation — measuring your human-layer resilience and turning the results into targeted awareness improvements.

Pricing Contact us Book a call
Overview

Most breaches start with a person.

Technology rarely fails first — people do. Social engineering testing measures how your staff respond to realistic deception, safely and ethically, so you can fix the gaps before a real attacker exploits them.

We design scenarios tailored to your organisation — spear phishing, vishing, pretexting, and USB drops — execute the campaign, and deliver detailed metrics on click, submission, and reporting rates, with a debrief and awareness recommendations.

Coverage

What we test.

Multi-channel social engineering tailored to the threats your people actually face.

Methodologies: NIST SP 800-115 OSSTMM Realistic scenarios Behavioural metrics
FAQ

Social engineering testing FAQ

The questions we're asked most about scope, cost, and timing.

How much does a social engineering or phishing test cost?
A social engineering engagement typically costs €2,000–4,000 depending on scenarios, channels, and headcount. Ongoing managed phishing is priced separately. Use our estimator for a tailored figure.
Is social engineering testing safe and legal?
Yes — all testing is authorised in writing, scoped carefully, and designed to measure and educate, never to harm or embarrass staff.
What do you measure?
Open, click, and credential-submission rates, plus the all-important reporting rate — how many people recognised and reported the attempt — tracked over time.
How is this different from awareness training?
Social engineering testing measures real behaviour under simulated attack; awareness training builds the skills. They work best together.
Will staff know it is a test?
Not in advance — that would defeat the purpose. Afterwards we run a constructive debrief and just-in-time coaching for anyone who engaged.
How do you choose the scenarios?
We tailor them to your sector, tooling, and current threats — and agree every scenario with your point of contact before launch.
Do you need employee details?
A target list of email addresses and/or phone numbers, handled strictly under NDA and deleted after the engagement.
How do you protect staff during testing?
Scenarios are designed to educate, not humiliate; results are reported in aggregate and individuals are coached, not penalised.
Can you target specific high-risk teams?
Yes — finance, executives, and IT are common focus groups for pretexting and spear-phishing scenarios.
How does this complement a phishing programme?
A point-in-time test measures current resilience; an ongoing managed awareness programme then drives sustained improvement.
Related services

Explore more.

Parent servicePenetration Testing→ RelatedRed Team Assessment→ RelatedSecurity Awareness→ RelatedPhysical Penetration Testing→

Ready to test your people?

A 30-minute scoping call costs nothing. One successful phish costs considerably more.

Book a meeting Send an email