Social Engineering

Phishing involves fraudulent emails intended to deceive recipients into clicking malicious links, downloading infected attachments, or entering credentials on fake websites. To address this threat, we create customised phishing simulations based on realistic scenarios tailored to your organisation. As a result, these tests effectively assess how well employees identify and respond to suspicious messages.

Vishing uses phone calls to impersonate trusted parties like IT support, HR, or external providers. Attackers aim to extract sensitive information such as passwords, system access, or financial details. To test this, our consultants make controlled calls using realistic and convincing pretexts. As a result, we assess how easily staff may be persuaded to share information over the phone.

Smishing, like phishing, uses text messages instead of emails to deceive users—often linking to fake sites or prompting harmful actions. To combat this, we send realistic SMS simulations, allowing you to assess your organisation’s mobile awareness and response more effectively.

This type of attack involves an attacker assuming a false identity - often as a visitor, contractor, or authority figure - to gain trust and access. Moreover, the pretext is carefully scripted to appear believable and persuasive. To assess your organisation’s defences, we conduct physical or remote impersonation attempts (with prior agreement). As a result, we evaluate how effectively staff verify identities and respond to unexpected or suspicious requests.

Tailgating and piggybacking attacks involve individuals using false identities to gain unauthorised access to secure areas. To appear credible, attackers often pose as delivery drivers, contractors, or authority figures. Additionally, they use scripted scenarios to make their approach more convincing. To test your organisation’s defences we conduct controlled impersonation attempts with prior agreement. In turn, this helps assess how well staff follow access control procedures and respond to unexpected situations.

Attackers often leave USB drives around office premises, hoping someone will plug them in out of curiosity. As a result, these drives may install malware or connect to an attacker-controlled server. To test this threat safely we plant harmless USBs with non-malicious payloads. This helps identify whether staff interact with them and how your systems respond.