Overview
Business email compromise and help-desk impersonation remain common ways into US companies, and many cyber insurance applications ask how staff are trained and tested. We run phishing and voice scenarios remotely, timed to your US working hours, and report results by group rather than by person. Physical access attempts need people on site, so we discuss those separately at scoping.
People are the vector most intrusions actually use, because a convincing message is cheaper and more reliable than a software exploit. A social engineering assessment measures how your organization responds to that pressure: whether staff spot a crafted phishing email, resist a confident pretext phone call, or challenge someone attempting to follow them through a door. The aim is to understand real behavior under realiztic conditions, not to trick individuals.
We design scenarios that mirror the lures your people would genuinely face, agreed with you in advance and tuned to be realiztic without being cruel. Email phishing campaigns measure not just who clicks but, just as importantly, who reports, since a workforce that raises the alarm quickly is more valuable than one that never clicks. Where in scope, we add voice pretext and physical access attempts, each run carefully and within clear, agreed boundaries.
The findings are deliberately constructive and never name individuals. We report rates and patterns, which departments and lure types performed well or poorly, how fast suspicious messages were reported, and where a reported attempt did or did not reach the right team. From that we recommend targeted awareness work and process changes, so the assessment leaves your people better prepared rather than simply judged.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Scoping & consentWe agree vectors, scenarios, boundaries and no-blame principles in writing.
- Scenario designWe build realiztic lures relevant to your people and sector.
- ExecutionCampaigns and attempts are run carefully within the agreed limits.
- MeasurementWe record click, report and response metrics by group and lure type.
- Report & awarenessWe deliver patterns, not names, with targeted awareness recommendations.
What you receive
- Click, submit and report rates by group and lure
- Analysis of reporting speed and process response
- Constructive findings that never identify individuals
- Targeted awareness and process recommendations
- Re-test option to measure improvement over time
Standards & frameworks
- MITRE ATT&CK
- NIST SP 800-115
- PTES
- OWASP WSTG
- CVSS v4.0
Frequently asked questions
Do you name the people who fail?
No. We report rates and patterns by group, never individuals, because a no-blame approach produces honest results and a willing workforce. Our goal is a team that reports faster next time, which naming and shaming actively undermines.
Is physical and phone testing always included?
Only where you want it and we agree it in scope. Email phishing is the most common starting point; voice pretext and physical attempts add depth but need extra planning and consent, so we scope them deliberately rather than by default.
How do you keep this ethical and legal?
Everything runs under written authorization with agreed boundaries, named safety contacts and scenarios designed to measure behavior, not to humiliate. We avoid lures that would cause genuine distress and stop immediately if an attempt risks real harm.
Is a red team or phishing exercise lawful in the US?
It should only happen with written authorization from the organization that owns the systems. The federal Computer Fraud and Abuse Act and state computer-crime laws treat unauthorized access seriously, so targets, limits, safety contacts and stop conditions are signed before any activity. Ask your counsel about your own position.
How does adversary simulation relate to SEC and NYDFS reporting?
Once an SEC registrant decides an incident is material, it has four business days to file under Form 8-K Item 1.05, and NYDFS Part 500 generally expects cybersecurity events to be reported within 72 hours. A red or purple team exercise shows whether your team would detect and escalate an intrusion fast enough to make those calls.