Social engineering assessments

• A finance, service-desk or reception procedure has changed.
• You want to examine how a suspicious request moves from the first recipient to the team responsible for responding.
• A red-team exercise needs an agreed human entry point, or you need a focused assessment of a single verification process.

Choose one business process, objective, audience and communication channel. Email, telephone or a visit to specified premises can be considered. Agree the scenario, timing and what counts as a successful report before any contact.

• How the approved team handles the request and whether the procedure prompts an independent identity check.
• Whether reporting reaches the right person and what happens next.
• For a separately authorised onsite scenario, how visitors are checked at the agreed location. The written scope defines where the tester can go.

• An accountable sponsor, the owner of the process and an approved participant group.
• The expected verification and reporting procedure, staff support arrangements and any excluded channels or sites.
• A nominated contact who can stop the exercise and decide whether the response team should know in advance.

Agreed boundaries

Agree the scenario with the sponsor and HR, including excluded groups, sensitive themes, the stop contact and how results will be shared. Use simulated actions. Keep real payments, live passwords and unauthorised premises outside the exercise.

A summary of what happened, where checks worked, where escalation stalled and what to change in the process. A debrief can connect the scenario to the actions your teams took.

Follow-up

Agree a focused follow-up after the process changes. For recurring email simulations, coaching and reporting trends across the workforce, explore managed phishing and security awareness training.