Most intrusions still begin with a person: a convincing email, a call from someone who claims to be IT support, a message from a manager who is supposedly in a meeting. Technical controls filter a part of it. The rest depends on whether people recognise the attempt and whether the process gives them a way to report it.
We run campaigns built the way real attackers build them, with every scenario approved by you in advance, and measure what matters: not only who clicked, but who reported, how fast the report reached the security team and what the team did with it.
01Scope
What we test
Phishing by email: credential capture, attachments, links
Targeted campaigns against roles with elevated access
Phone calls to the help desk and to employees
Messengers and collaboration platforms
Multi-factor authentication: real-time phishing and push fatigue, where agreed
Help desk procedures: identity verification before a password or MFA reset
Reporting channel: whether a report reaches the security team, and how fast
02Approach
How the work is done
01
Scenario design
Scenarios are written and approved one by one. No scenario uses threats, personal hardship or health, and none targets private accounts or devices.
02
Preparation
Domains and infrastructure are prepared for the campaign. You decide whether the test measures the people alone or the people together with the mail filters.
03
Campaign
Messages and calls go out in waves. The control group in your organisation is informed of each wave.
04
Analysis
Results are aggregated by group and by scenario. The report contains no names and no data that identifies an individual.
Planning, rules of engagement and conduct of technical testing.
NIST
06Questions
Questions about this service
Will employees be named in the report?
No. Results are reported by group and scenario. The purpose is to improve the process, not to find someone to blame. Naming people destroys their willingness to report, and reporting is the most valuable control there is.
Is it lawful to send phishing emails to our own employees?
With the authorisation of the employer and within the labour and data protection law of your jurisdiction. In some countries employee representatives must be consulted. We raise the question during scoping; the legal assessment is made by your lawyers.
Do you collect real passwords?
No. Submitted credentials are not stored and not used; the campaign records only that a submission took place. Where a bypass of MFA is in scope, it is demonstrated on test accounts created for the purpose.