External Network Penetration Testing
Attack-surface discovery and exploitation across everything you expose to the internet: perimeter services, remote access, cloud-hosted assets, and the forgotten hosts that never made it onto the inventory.
Service 07
Social engineering assessments
Most breaches still start with a person being convinced to click, call back, or hold a door open. We test that safely and respectfully, so you learn where your processes need support before an attacker finds out first.
Overview
The problem we are solving
Social engineering assessments measure your organization, not individual employees. The goal is to find the processes that make an attack easy (a help desk that resets MFA on a phone call, a finance team that pays a changed invoice, an email filter that lets a lookalike domain through) and to show how well reporting and response work when someone does take the bait.
Campaigns are built around realistic, current attacker techniques, tailored to your organization and industry, and run under rules of engagement agreed in advance with a small group on your side. We avoid pretexts that would cause real distress, and results are reported in aggregate unless you specifically agree otherwise.
Social engineering pairs naturally with external testing, since a captured credential or opened payload is often the first step of a real intrusion.
Coverage
Campaign types
Scope is agreed up front; these are the areas an engagement typically covers.
- Email phishing
- Credential harvesting, payload delivery, and MFA-bypass phishing, built on realistic pretexts and lookalike infrastructure.
- Vishing
- Phone-based pretexting against help desks and staff, including password reset, MFA enrollment, and account recovery processes.
- Smishing & multi-channel
- SMS and messaging-platform lures, and campaigns that combine channels the way modern attackers do.
- Business process abuse
- Testing invoice, payment, and vendor change procedures against business email compromise style pretexts.
- On-site pretexting
- In-person impersonation and tailgating to test reception, badge, and visitor procedures, run under agreed rules of engagement.
- Detection & reporting
- How quickly suspicious messages and calls are reported, and whether your security team responds before damage is done.
Methodology
How the engagement runs
-
01
Scoping & rules of engagement
Agree targets, channels, pretexts, timing, off-limits topics, and the small group on your side who knows the campaign is running.
-
02
Reconnaissance
Open-source intelligence on your organization, roles, and public footprint to build realistic, tailored pretexts.
-
03
Campaign build
Infrastructure, lures, and scripts prepared and reviewed with your trusted contacts before launch.
-
04
Execution
Campaigns run in the agreed window with real-time tracking, and any captured credentials are handled securely and reported immediately.
-
05
Reporting
Aggregate results, process weaknesses, detection and reporting metrics, and practical recommendations for controls and training.
-
06
Debrief
A walkthrough with leadership and security, focused on process and control improvements rather than individual blame.
Deliverables
What you receive
- Campaign report with aggregate results by channel and department
- Process and control weaknesses identified, with recommended fixes
- Detection and reporting metrics
- Technical findings on email security and infrastructure controls
- Recommendations for targeted awareness training
- Live debrief with leadership and security
Aligned to
- MITRE ATT&CK (Initial Access & Reconnaissance)
- Penetration Testing Execution Standard (PTES)
Questions
Frequently asked
Will you name the employees who clicked?
By default, results are reported in aggregate. Individual results are only shared if you specifically request it and it fits your internal policies.
Can you test our help desk?
Yes. Help desk vishing around password resets and MFA enrollment is one of the most valuable tests we run, because it mirrors how several high-profile breaches began.
Are there pretexts you will not use?
Yes. We avoid pretexts that would cause real distress, such as fake layoffs, medical emergencies, or bonuses, and agree any sensitive themes with you in advance.
Related
Often scoped together
Red Team & Adversary Emulation
Goal-based, stealthy campaigns that emulate a real threat actor end to end, measuring whether your people, processes, and tooling detect and stop an intrusion, not just whether one is possible.
Get started
Ready to scope social engineering?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com