Social engineering
Social engineering assessments
Attackers do not always hack their way in. Sometimes they just ask. We test whether your helpdesk, finance team and staff can be persuaded to reset a password, change bank details or let someone in.
Who it is for
- Organisations whose IT helpdesk resets passwords or MFA over the phone
- Finance teams that handle payments and supplier bank details
- Businesses worried about the impersonation attacks behind recent high-profile breaches
- Teams that want to test their processes, not just awareness training
What we cover
Vishing
Phone calls impersonating staff, IT support, suppliers or senior leaders to obtain information or access.
Helpdesk verification
Whether an attacker could get a password or MFA reset by pretending to be one of your staff.
Payment fraud
Fake invoice and bank detail change requests that test your finance verification checks.
Smishing
SMS messages that lure staff to fake login pages or ask them to call a number back.
In-person pretexting
Posing as visitors, contractors or delivery drivers to see how far we get. Pairs well with a physical assessment.
Open-source research
What an attacker can learn about your organisation and staff from public sources before they make contact.
How it works
Scope
We agree channels, targets, pretexts and exactly what we are allowed to ask for.
Research
We build believable pretexts from public information, the way a real attacker would.
Engage
We make contact and log every attempt in detail, stopping short of anything that could cause real harm.
Report
Each attempt and its outcome, with the process changes that would have stopped us.
What you get
- Report of every attempt, the pretext used and the outcome
- Process weaknesses with recommended verification steps
- Summary of what we learned about you from public sources
- Anonymised examples you can use in staff training
- Debrief call with your team
Frequently asked questions
Can't find your answer? Ask in the form below and we will get back to you as soon as we can.
Is social engineering testing legal?
Yes, when it is authorised. We only test with written permission from you, within agreed rules. We do not impersonate the police or other authorities, and we avoid pretexts designed to cause distress.
Will individual staff be identified?
Only if you ask, and we agree how the results will be handled first. The aim is to fix processes, not to blame people. Most of our recommendations are about verification steps, not individuals.
How is this different from a phishing campaign?
Phishing campaigns measure how a large group responds to emails. Social engineering is targeted and interactive: phone calls, SMS and in-person approaches aimed at specific teams like the helpdesk or finance.
Can you test our helpdesk without them knowing?
Yes, that is usually the point. We agree a contact who knows about the test, so a call can be confirmed as us if it gets escalated.
Get a fixed quote
A few quick questions so we can scope it properly. No obligation, no hard sell.
Thanks, we have your enquiry.
We will reply as soon as we can. If it is urgent, email hello@redstackd.com.