Human and corporate surface
Organisational structure, email naming conventions, technology in use inferred from job adverts, metadata in published documents, credentials in breach dumps and executive personal exposure.
Service 06
Social engineering, OSINT and physical intrusion
The human vector remains the most profitable route for an attacker and the worst measured by the organisation. Most awareness campaigns measure who clicked. What matters is how many minutes pass before somebody reports it, and what happens in that interval.
Criteria
The organisation is measured, never the person
A social engineering exercise that ends in a list of names is a failed exercise and, on top of that, an employment problem. What is being evaluated is whether processes and controls hold, not whether one employee had a bad day.
- Results are delivered aggregated by department and risk profile. No individual is identified in the report.
- Where works council consultation applies, it is resolved before the campaign is launched.
- The headline metric is not click rate: it is time to first report and the proportion of recipients who reported it.
- No lure uses themes capable of causing real harm: payroll, redundancy, health and personal matters are out of scope.
Scope
Vectors
Prior reconnaissance is what separates a generic campaign from one that works. And it does work: with the right pretext, credential capture rates comfortably exceed what management expects.
OSINT
Phishing
Targeted campaigns
Dedicated infrastructure with registered domains and aged reputation, lures aligned to real internal processes, and measurement of click, credential capture, execution and reporting.
Vishing
Voice and impersonation
Telephone pretexting against helpdesk and users: password reset, device enrolment and second-factor redirection. The highest-yield vector and the one worst covered by procedure.
Physical
Facility access
Tailgating at controlled entrances, supplier and maintenance impersonation, assessment of reception handling and staff reaction, and verification of what is reachable once inside.
Delivery
What gets measured
Five indicators, comparable across successive campaigns. They are the only way to know whether awareness investment changes anything.
01
Open
Proportion of recipients who open the lure. Measures reach, not vulnerability.
02
Click
Interaction with the link or attachment. The metric everyone publishes and the least useful.
03
Credential
Proportion entering credentials or a second factor. Real compromise starts here.
04
Report
Proportion who report it and time to first alert. The indicator that actually matters.
05
Containment
Time from first report until your team blocks the campaign.
FAQ
Frequently asked
Is simulated phishing against our own staff lawful?
Yes, where the company owns the systems and corporate mail, provided the data processing is limited to what is necessary, recorded in the register of processing activities and appropriately disclosed. In organisations with employee representation, prior consultation should be resolved before launch. None of this compromises the exercise: you do not have to announce the date or the content for the campaign to be valid.
Will we find out who fell for it?
The report does not identify individuals. Data is aggregated by department, profile and time of day, which is what supports decisions about processes and training. If your organisation wants individual detail for internal action, that is your decision and it must be provided for in your internal policies and staff disclosures; I do not include it by default.
Does this include physical intrusion?
Only where the scope expressly covers it and with a signed authorisation letter that I carry throughout the engagement, with a verification phone number available to security staff. It is the most delicate vector because of the risk of staff reaction and the criminal implications of acting without documented cover, so it is never improvised.
Which one fits your case?
Describe the environment and the reason behind the engagement. I will reply with the recommended mode and an estimated order of effort.