Social Engineering

Find out how easily attackers could manipulate people and procedures to bypass your security. See where they could get through and gain clear, actionable insight into what to strengthen next, from security awareness and protocols to technical controls.

Do you recognize this?

Your security depends on more than technology. People and procedures have to hold up too.

Human behaviour varies

Stress, urgency and routine even make security-aware employees easier to manipulate. One wrong decision can bypass the technology built to protect your organisation.

AI makes deception harder to spot

Deepfakes, voice cloning and convincing AI-generated messages remove many of the warning signs people have learned to recognise.

Reports are not always followed up

An employee may recognise a suspicious situation but not know where to report it. Or a report may get lost between different teams. That is why we assess not only whether someone recognises the attack, but also what happens next.

Shadow IT puts data out of sight

When employees use unapproved tools, apps or AI services, sensitive data can leave the company’s controlled environment without anyone noticing.

How we work

We don’t stop when the attack succeeds. We uncover why it worked, then use those findings to strengthen procedures and train your employees on the behaviours that proved vulnerable.

Define what you want to test

Together, we define the objective and scope. Which behaviour, procedure or risk do you want to put to the test? This could include sharing sensitive information, physical access, folowing procedures or responses to suspicious communication.

Build the attack scenario

Based on the objective, we determine the most realistic attack method. This could involve phishing, vishing or a mystery guest, but also a combination of techniques or a fully tailored scenario.

Execute the attack

Our social engineers execute the scenario from an attacker’s perspective, putting employees, procedures and security measures to the test to uncover where they could be bypassed.

Analyse behaviour and procedures

We don’t just investigate whether the attack succeeded, but why it worked. What decisions were made? Which procedures worked or failed? And where was there room for manipulation?

Turn the attack into change

You receive concrete findings that help you address vulnerable behaviour and strengthen procedures. Where relevant, we turn those findings into targeted security awareness training for your employees, based on what actually happened during the attack

Our attack techniques

We use different techniques to test how attackers can manipulate or bypass people to gain information, access or a foothold in your organisation.

Phishing and spear phishing

We create credible emails tailored to the organisation’s context. This allows us to test whether employees recognise suspicious requests and follow the correct reporting procedure.

Vishing and spoofing

We use realistic phone scenarios and spoofed caller identities to test whether employees recognise manipulation before sharing sensitive information or providing access. Calls can appear to come from a trusted source, such as a customer service line or a colleague’s number, making the scenario harder to recognise as an attack.

Mystery guest

Our mystery guests attempt to enter your premises and workspaces, testing how employees and access controls handle unauthorised access and whether security procedures are followed.

OSINT

We onderzoeken welke informatie over jouw organisatie openbaar beschikbaar is en hoe een aanvaller die kan gebruiken om een geloofwaardige pretext op te bouwen. Denk aan informatie over medewerkers, leveranciers, gebruikte systemen en interne werkwijzen.

Your primary point of contact

“A successful attack is only the start. What matters is understanding why it worked, so the same route isn’t open to a real attacker.”

Bas Cijscouw

Ethical Hacker

In practice

This is how we approach it in a real-life scenario.

Anonymous clientcase – Mystery guest

For an organisation with around 10,000 employees, we conducted a mystery visit to test whether its physical security and employee awareness could withstand a realistic social engineering attack.

Within five hours, our mystery guest gained access to workplaces, sensitive information, the corporate network and an unlocked server room without triggering an alarm. This gave the organisation concrete evidence of how far a real attacker could get and where security needed to be strengthened most.

FAQ

Will employees know they are being tested?

A trusted point of contact within your organisation is aware of the engagement and helps ensure the test remains controlled without compromising the scenario.

What happens if an employee falls for the attack?

We analyse why the attack worked and where behaviour, procedures or security controls failed. The goal is to learn from what happened and strengthen your security, not to blame individuals.

What is the difference between phishing and vishing?

Phishing uses deceptive messages, usually email, while vishing uses phone calls or voice communication to manipulate someone into sharing information, providing access or taking an action.

Can you combine multiple attack methods in one scenario?

Yes. Phishing, vishing, physical access and other techniques can be combined to create a realistic attack scenario tailored to your objectives and risks.

What do we need to get started?

We mainly need a trusted point of contact who stays involved throughout the engagement. Together, we define the objectives, scope, boundaries, timeframe and attack scenario before testing begins.

When does the test end?

A fixed testing period, usually a number of days or weeks, is agreed upfront. The test ends when this period is over or, depending on the scenario, when the agreed objective has been reached.

Take Social Engineering further

Pentesting

Test your technology as well as your people. Find out what access an attacker could gain after a successful social engineering attack, for example through compromised accounts, active sessions or a connected device.

Security Awareness Training

Turn real Social Engineering findings into a security awareness training for your employees.

Red Teaming

Go beyond testing your people. Use social engineering as part of a realistic attack and discover whether an attacker can stay under the radar while working towards a predefined objective.

Ready to test your
human defences?

Let’s discuss your challenge in a free introductory call.