Social engineering testing is an authorised assessment of how well an organisation's people and processes resist manipulation - not how well its technology resists attack. Rather than exploiting a software flaw, the tester persuades employees to do something that helps an attacker: click a malicious link, reveal a password, approve a fraudulent request, or let an unauthorised person into a building. It reflects reality - attackers target people because it's often easier than defeating technical controls (firewalls, patching and MFA have improved; a convincing message hasn't gotten harder to fall for). Techniques span phishing, vishing (phone), pretexting, and physical tailgating. A phishing simulation sends realistic-but-harmless messages to your own staff (with permission) to measure clicks, credential entry and reporting - to improve, not punish. Do it ethically: authorised, scoped, aggregate reporting, no blame, careful data handling. Delivered as social engineering & phishing, often within a red team.
// 01 What social engineering testing is
Social engineering testing is an authorised assessment of how well an organisation's people and processes resist manipulation, rather than how well its technology resists attack. Instead of exploiting a software flaw, the tester attempts to persuade employees to do something that helps an attacker - such as clicking a malicious link, revealing a password, approving a fraudulent request, or letting an unauthorised person into a building. It reflects the reality that attackers frequently target people because it's often easier than defeating technical controls. A social engineering test measures how staff respond to realistic deception, identifies where awareness and processes are weak, and provides the evidence to improve training, procedures and defences - all conducted with the organisation's permission and within agreed boundaries. It's the human-focused complement to a technical penetration test.
// 02 Why attackers target people, not systems
Attackers target people because humans are often the most reliable and cost-effective way into an organisation. Technical defences - firewalls, patching and multi-factor authentication - have improved, making purely technical intrusion harder. But a well-crafted message or phone call can persuade a person to hand over access directly, sidestepping those controls. People can be influenced by authority, urgency, fear, curiosity and helpfulness, and a convincing pretext exploits these instincts. Because a single employee granting access or revealing a credential can undo a great deal of technical security, and because staff are numerous and human error is inevitable, social engineering has become one of the most common starting points for real breaches - increasingly amplified by AI-driven tricks like deepfake voice phishing. Testing this dimension addresses the way organisations are actually attacked.
// 03 The techniques & the phishing simulation
Phishing
Deceptive emails/messages luring a click, an attachment, or credentials on a fake page.
Vishing
Phone-based pretext calls persuading staff to reveal information or take an action.
Pretexting
A fabricated scenario and identity that makes the request seem legitimate.
Tailgating
Physical - following staff through a door into a restricted area.
A phishing simulation is a controlled exercise in which an organisation sends realistic but harmless phishing-style messages to its own staff, with permission, to see how they respond. It measures how many click a link, open an attachment, or enter credentials on a simulated fake page - and, just as importantly, how many report the message as suspicious. The purpose is not to catch people out or punish them, but to understand real susceptibility, provide targeted awareness training, and track improvement over time. Good simulations are realistic enough to be meaningful, are tied to constructive follow-up rather than blame, and measure positive behaviours like reporting as well as failures. Repeated periodically, they show whether awareness efforts are actually working.
// 04 How to run it ethically
Ethical social engineering testing is always authorised, scoped and bounded in advance, and designed to improve the organisation rather than embarrass individuals. Before any activity, the organisation agrees what techniques are permitted, which people or areas are in and out of scope, and where the limits lie, and a responsible point of contact is aware the test is happening even if the wider workforce isn't. Results are reported at an aggregate level focused on systemic weaknesses and improvement - not to single out or discipline individuals, since a blame culture discourages reporting and makes security worse. Any sensitive personal information gathered is handled carefully and not retained unnecessarily. Done this way, the test builds a stronger, more aware organisation while respecting the staff who are part of it - the same ethical frame that governs a red team, within which social engineering often runs. It follows our methodology and rules of engagement.
// 05 Frequently asked questions
What is social engineering testing?
An authorised assessment of how well an organisation's people and processes resist manipulation, rather than how well its technology resists attack. Instead of exploiting a software flaw, the tester attempts to persuade employees to do something that helps an attacker - clicking a malicious link, revealing a password, approving a fraudulent request, or letting an unauthorised person into a building. It measures how staff respond to realistic deception, identifies where awareness and processes are weak, and provides evidence to improve training, procedures and defences - all with permission and within agreed boundaries.
Why do attackers target people instead of systems?
Because humans are often the most reliable and cost-effective way in. Technical defences like firewalls, patching and MFA have improved, making purely technical intrusion harder, but a well-crafted message or phone call can persuade a person to hand over access directly, sidestepping those controls. People are influenced by authority, urgency, fear, curiosity and helpfulness, and a convincing pretext exploits these instincts. Because a single employee can undo a great deal of technical security, and human error is inevitable, social engineering has become one of the most common starting points for real breaches.
What is a phishing simulation?
A controlled exercise in which an organisation sends realistic but harmless phishing-style messages to its own staff, with permission, to see how they respond. It measures how many click a link, open an attachment or enter credentials on a simulated fake page, and how many report the message as suspicious. The purpose isn't to catch people out or punish them, but to understand real susceptibility, provide targeted awareness training, and track improvement over time. Good simulations are realistic, tied to constructive follow-up rather than blame, and measure positive behaviours like reporting as well as failures.
How is social engineering testing done ethically?
It's always authorised, scoped and bounded in advance, and designed to improve the organisation rather than embarrass individuals. Beforehand, the organisation agrees what techniques are permitted, which people or areas are in and out of scope, and where the limits lie, and a responsible point of contact knows the test is happening even if the wider workforce doesn't. Results are reported at an aggregate level focused on systemic weaknesses, not to discipline individuals, since a blame culture discourages reporting. Sensitive personal information is handled carefully and not retained unnecessarily.
// 06 Related reading
- Social engineering & phishing service and what is red teaming.
- Deepfake & voice phishing — AI-amplified social engineering.
- Wireless testing — where evil twins exploit the same human trust.