Social Engineering
Test the human layer without blaming the humans.
Most breaches start with a person, not a zero-day. We run realistic phishing, vishing, and physical intrusion simulations to show where your processes let an attacker through — and report on controls and procedures, not on the individuals who clicked.
What we cover
Every engagement is scoped to your environment — these are the areas we typically work across.
Phishing campaigns
Targeted and broad campaigns — credential harvesting, payload delivery, and MFA bypass techniques — built on real reconnaissance of your organization.
Vishing
Phone pretexting against your help desk and staff, impersonating employees, vendors, or IT to test verification procedures like password and MFA resets.
Physical intrusion
Tailgating, badge cloning, and on-site pretexting to test whether someone who doesn't belong can walk into your office or server room.
OSINT exposure assessment
What an attacker can learn about your organization and your people from public sources before they ever make first contact.
What you get
- Aggregate results — open, click, submit, and report rates — without naming individuals
- Analysis of which controls worked and which didn't: filtering, reporting, verification
- Recommendations for process changes and targeted awareness training
- Evidence documentation for physical and phone-based tests
- Debrief with the stakeholders who own the affected processes
- Methodology
- Scenarios modeled on techniques used in real-world intrusions, mapped to MITRE ATT&CK
- Timeline
- Scoped individually — campaign length and test windows are agreed during scoping.
- Confidentiality
- NDA signed before scoping. Evidence encrypted and deleted on an agreed schedule.
Social Engineering FAQ
Will you name employees who fell for it?
By default, no. Results are reported in aggregate. The goal is to fix processes and controls — shaming individuals makes people less likely to report the next real attack.
Is this kind of testing legal?
Every engagement runs under signed written authorization with a defined scope, and physical testers carry an authorization letter. We work with your HR and legal teams during scoping so the campaign fits your policies and local law.
Does MFA stop phishing?
Not always. Many MFA setups can be bypassed with adversary-in-the-middle phishing or push fatigue. We test whether yours holds up against the techniques attackers actually use today.
Talk to us about Social Engineering.
Tell us what you're trying to protect. We'll tell you honestly whether we're the right fit.
contact@ironclav.com · Response within one business day