Social engineering: the attack vector technology can't block
The human element is involved in roughly 6 out of every 10 data breaches, according to the Verizon DBIR. We simulate real social engineering attacks — phishing, vishing, pretexting — to measure and improve your team's resilience before a real attacker does.
Scope your project · Request a simulation
Rather talk it through? Call us at +34 960 730 013
The weakest link isn't in your code
You can have the best firewall on the market, up-to-date patches and a strict password policy. But if one employee clicks a well-crafted email, hands over credentials on a convincing call, or plugs in a USB drive found in the parking lot, everything else collapses. Social engineering exploits human trust, urgency and authority — and those factors don't go away with technology.
Available simulation types
- Mass phishing: email campaign simulating real threats (invoices, IT alerts, HR)
- Spear phishing: personalized attacks on high-value profiles (CEO, CFO, IT admin)
- Vishing: phone calls impersonating IT support or authorities
- Smishing: malicious SMS mimicking banking or HR alerts
- In-person pretexting: controlled attempt at unauthorized physical access
- USB drop: USB devices placed in controlled environments to measure response
- Combined campaign: several simultaneous vectors (phishing + vishing + in-person) in a single exercise
How we do it
- Scenario definition: We agree the simulation type, difficulty level and concrete objectives with leadership.
- OSINT reconnaissance: We gather public information about the company and target profiles to build credible, personalized pretexts.
- Controlled execution: We launch the campaign within the agreed scope. Everything is documented and no real data is exfiltrated or stored.
- Results analysis: We measure open rates, clicks, submitted credentials, completed calls and any agreed indicator.
- Report and training: We deliver the report with results by department and offer an awareness session for the affected teams.
Service deliverables
- Results report by department and profile
- Attack success rate with sector benchmark comparison
- Identification of high-risk profiles
- Technical and process recommendations
- Post-simulation awareness session included
- Phishing incident response policy
Who should run this test?
- Companies that suspect their team doesn't spot well-crafted phishing emails
- Organizations with high staff turnover or large recent onboarding waves
- High-risk sectors: finance, healthcare, legal, HR and customer support
- Companies that want to measure the real effectiveness of their training programs
- Any company that must meet the awareness requirements of NIS2 or ISO 27001
Frequently asked questions
Will employees know it's a simulation?
Not during execution, so the results are representative. They will afterward, during the awareness session. Leadership is always informed before it starts.
What happens if an employee falls for the phishing attempt?
Nothing negative. The goal is educational, not punitive. The employee will see a notice page explaining they just took part in an exercise and what signs they should have noticed.
How often should this be done?
At least twice a year to maintain alertness. Organizations with higher exposure or that handle sensitive data should do it quarterly.
Can we exclude certain departments?
Yes. We can segment the scope by department, access level or any criteria you need.
Could this end up singling out individual employees?
No, and the exercise is deliberately designed to prevent it. Results are delivered aggregated by department or profile, never as a list of who fell for it. The goal is to measure the organization's resilience and the effectiveness of its controls, not to build a case file. An exercise used to single people out destroys the trust needed for staff to report incidents, which is exactly the capability you want to strengthen.
Do we have to tell staff an exercise is coming?
Announcing that simulations will take place at some point during the year is advisable and is often required by applicable labor and data protection rules. Announcing the specific date destroys the measurement. The usual balance is to state in the security policy that periodic exercises are run, without detailing when or with what pretext, and to agree the scope with HR and employee representatives before starting.
What click rate is acceptable?
The click rate on its own says little, because it depends enormously on how plausible the pretext is: a generic email and one built from real company information give incomparable results. The metrics that do guide you are the reporting rate — how many people alert the security team — and time to first report. An organization with clicks but fast reporting is in better shape than one with no clicks and no alerts at all.
Specialised services
Related resources
- What is social engineering: techniques and examples
- Types of corporate phishing
- CEO fraud: how it works and how to stop it
- Vishing and voice deepfakes
- Are phishing simulations on employees legal?
- What is ethical hacking?
Sources
- Verizon Data Breach Investigations Report — the source for the human element being involved in roughly 6 out of 10 breaches, year after year
- ENISA Threat Landscape 2025 — phishing as the leading initial access vector in the EU, at around 60% of observed cases
Ready to protect your business?
Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.