Social Engineering Assessments

Test how your staff and premises withstand a realistic attacker

Phishing simulations and physical intrusion testing to assess how your staff, processes and premises withstand realistic attack attempts. Every assessment runs under agreed rules, with results reported in aggregate by default.
Get a Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Social Engineering Testing

What social engineering assessments cover

Attackers don't always attack systems. A convincing email or an unchallenged visitor can give them access that technical controls were built to prevent. Social engineering assessments test how your staff, your processes and your premises respond to that kind of approach.

We run two types of assessment: phishing simulations, which test staff and your email defences, and physical intrusion testing, which tests whether someone can gain access to your premises and reach sensitive areas. They can be run separately or together, and both can form part of a wider red team engagement.

What we test

  • Phishing emails
  • Credential harvesting
  • Email security controls
  • Physical access
  • Staff awareness

Why test people?

Technical controls can be strong while a convincing email or an unchallenged visitor still gets an attacker in. These assessments show where people and processes need support, and are not designed to single anyone out.

Who Needs This

Who needs a social engineering assessment?

Any organisation that wants to know how its people and premises hold up, not just its systems.
Get a Social Engineering Quote

Organisations looking beyond technical security

Once your networks and applications have been tested, people and premises are the other routes in. See our penetration testing services for the technical side.

Teams measuring staff awareness

A phishing simulation gives you click, report and credential-entry rates, so you can see where awareness stands and whether it improves after follow-up.

Sites with sensitive areas

Offices and sites where getting into the building could lead to access to systems, equipment or data.

Organisations preparing for a red team

Social engineering is one of the routes in a red team engagement. Testing it separately first shows how well it works on its own.

Phishing Simulation

What a phishing simulation includes

We agree the scenario, the staff in scope and the timing with you before anything is sent. Our article on email phishing attacks explains the techniques attackers use.

  • Simulated phishing emails

    Realistic emails sent to agreed staff, measuring who clicks and who reports the message.

  • Credential harvesting pages

    Look-alike login pages that show whether staff would enter their credentials.

  • Email security control testing

    We assess whether the simulated messages reach their intended recipients and how your email filtering and spam protection handle them. Email authentication controls such as SPF, DKIM and DMARC are reviewed as part of a spoofing attack vector. See our guide to DMARC policy configuration and related articles for more details.

  • Awareness follow-up

    A debrief or short awareness session for staff after the exercise, so the results lead to better habits.

  • Results reported in aggregate

    Assessment results are reported by organisation or team by default, including click, reporting and simulated credential-submission rates. Individual-level reporting is only provided where explicitly agreed, appropriately authorised, and consistent with applicable privacy requirements.

Physical Intrusion Testing

What physical intrusion testing includes

A consultant attempts to enter agreed premises and reach specified areas, working within written authorisation and the rules of engagement. The report records which controls prevented access, where they fell short, and what the consultant was able to access. Before testing starts, we establish the following safeguards.

  • A signed authorisation letter on site

    The consultant carries signed evidence of authority to test.

  • A named client contact throughout

    Someone reachable who can confirm the test and stand it down if the consultant is challenged.

  • Agreed targets, areas and hours

    Which buildings, areas and times are in scope, and which are off limits.

  • Written rules on evidence and safety

    We agree how evidence may be collected and handled, which areas and activities are off limits, and what to do if a safety concern arises. No items are removed unless explicitly authorised in the rules of engagement.

Our Methodology

How we run a social engineering assessment

Every assessment runs under written rules of engagement and authorisation agreed before any activity starts.
01

Scoping & Authorisation

We agree what is tested, the staff or sites in scope, the limits on our activity and who needs to approve it, such as HR and legal for a phishing simulation. Authorisation is confirmed in writing.
02

Research

We gather publicly available information about your organisation, as an outsider would, to make the scenario realistic. See our OSINT and reconnaissance service.
03

Preparation

We design the scenario, whether that is a set of phishing emails or a plan for a site visit, and agree it with you before it starts.
04

Execution

We run the phishing campaign or the site visit under the agreed rules, with your contacts available throughout.
05

Reporting & Debrief

A report documenting the scenarios attempted, the results achieved, relevant supporting evidence and weaknesses identified. We provide prioritised recommendations and a debrief to help your team improve controls and processes. Phishing results are reported in aggregate by default.

Pricing

Social engineering assessments are scoped individually

The length depends on the number of staff, sites and campaigns, and is agreed in scoping. We agree a fixed price before work starts. Tell us the following in your quote request and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. See the pricing guide for the services we publish prices for.

  • What you want tested

    Phishing, physical intrusion or both, and roughly how many staff and sites are involved.

  • Your rules

    Any staff, areas or times that are off limits, and who needs to approve the exercise.

  • Your timing

    Any deadline, awareness campaign or audit behind the assessment.

Common Questions

Social engineering assessments: frequently asked questions

We scope social engineering assessments individually and agree a fixed price before work starts. The number of staff, sites and campaigns drive the effort.

Our penetration testing pricing guide compares costs across the services we publish prices for.

Not by default. Results are reported in aggregate by organisation or team, helping you understand overall trends without singling out individual staff.

If individual-level reporting is required, we agree the purpose, access arrangements and reporting approach in advance, subject to appropriate authorisation and applicable privacy requirements.

We agree this in scoping. The staff being tested will usually not know in advance, so organisations commonly involve HR and legal before an exercise starts. We confirm the authorisation in writing before any activity begins.

It runs only with a signed authorisation letter on site, a named client contact reachable throughout, agreed targets, areas and hours, and written rules on evidence and safety, including a stop rule if anyone is at risk.

Our standard approach does not include destructive testing.

Our CREST accreditation is for penetration testing. Social engineering assessments are a separate service, and we don't claim CREST accreditation for them.

You can request a quote using the form on our quote page. Say whether you want phishing, physical testing or both, how many staff and sites are involved, and your preferred timing.

We reply within one business day to confirm your scope, then send a fixed-price written proposal.

Ready to scope a social engineering assessment?

Tell us what you want tested and any limits you need, and we'll agree a scope and a fixed price.
Book a Scoping Call