Offensive Security · Social Engineering

Test the layer that attackers use first - people!

Phishing, vishing, pretexting, and physical access engagements that test the human layer of your security program. Calibrated to your industry and your environment. Designed to inform training and policy, not to embarrass employees.

Talk to an expert →

Engagement types

Sector-calibrated

Pretexts and scenarios

Policy-led

Findings and recommendations

Four engagement types

The human layer tested from every angle.

Social engineering engagements are scoped to reflect the actual tactics adversaries use. Not generic phishing templates that everyone recognises.

01 · Phishing

Email phishing campaigns

Targeted phishing simulations using pretexts calibrated to your organization and sector — regulatory notifications, IT helpdesk resets, payroll updates, or vendor communications. Campaigns can target the whole organization, a specific department, or high-value individuals. Results show click rates, credential submission rates, and reporting behavior.

02 · Vishing

Voice phishing calls

Simulated calls to staff posing as IT support, auditors, vendors, or leadership. Tests whether employees disclose credentials, authorise actions, or take instructions from an unverified caller, a primary attack vector in business email compromise and fraud schemes.

03 · Pretexting

Multi-channel pretexting

Extended engagements build a credible cover identity to gain trust over time. By combining email, phone, and sometimes in-person contact, this tests the resilience of your team. Particularly relevant for organizations with high-value IP or sensitive client data.

04 · Physical

Physical access testing

Tailgating, visitor badge exploitation, document handling assessment, and on-site social engineering at offices, studios, data centres, or branches. Test whether physical access controls hold up against a confident, prepared attacker and whether staff challenge unknown individuals appropriately.