Social Engineering
Test your human defences against phishing, vishing, and other manipulation techniques.
What this assessment covers.
Social engineering attacks target the human element of your organisation — often the weakest link in the security chain. DERISK’s Social Engineering service tests your organisation’s human defences against manipulation techniques such as phishing, vishing, smishing, and physical pretexting.
Our assessments help organisations identify weaknesses in employee awareness, security processes, and response capabilities. We simulate real-world attack scenarios tailored to your organisation’s context, measuring how employees respond to crafted lures, fraudulent communications, and social manipulation techniques.
How we test.
A structured, expert-led methodology from initial reconnaissance through to real-time reporting and remediation guidance.
- 01
Target Reconnaissance & Pretext Development
We gather publicly available information about your organisation and employees to craft realistic attack pretexts that mimic the techniques used by real-world social engineers.
- 02
Phishing Campaign Execution
We launch controlled phishing campaigns — email-based lures designed to test employee susceptibility to credential harvesting, malicious attachments, and fraudulent links.
- 03
Vishing & Smishing Simulation
We conduct voice-based (vishing) and SMS-based (smishing) social engineering attacks to test how employees respond to phone calls and text messages from impersonated entities.
- 04
Physical Pretexting (Optional)
Where agreed in scope, we simulate physical social engineering attempts — such as tailgating, impersonation, and pretext visits — to test on-site security controls and staff vigilance.
- 05
Real-time findings published to the DERISK PTaaS portal
Results of each social engineering exercise are published live to the PTaaS portal with metrics on click rates, credential capture, and reporting behaviour for immediate visibility.
- 06
Reporting & Awareness Recommendations
You receive a detailed report with susceptibility metrics, identified weaknesses, and targeted recommendations for improving security awareness training and response processes.
Why teams choose us.
Expert-led, manually validated, and delivered through the DERISK PTaaS platform for continuous visibility and rapid remediation.
Outstanding Features
- ✓Realistic phishing, vishing, and smishing simulations tailored to your organisation
- ✓Real-time metrics and reporting through the DERISK PTaaS platform
- ✓Optional physical pretexting to test on-site security controls
- ✓Targeted awareness training recommendations based on assessment results
Why Choose Our Service?
- ▸Human element testing: Identify weaknesses in employee awareness and response before real attackers exploit them
- ▸Realistic simulation: Campaigns are crafted using publicly available information to mirror real-world attack techniques
- ▸Measurable results: Track click rates, credential capture, and reporting behaviour to quantify your human risk
- ▸Actionable recommendations: Receive targeted training and process improvements to strengthen your human defences
Frameworks & standards.
Testing is aligned with industry-recognised frameworks and standards to ensure comprehensive, repeatable coverage.
What you receive.
Everything you need to understand, prioritise, and remediate findings — delivered through the platform with ongoing validation.
Social Engineering questions.
What techniques do you use?
Phishing and spear-phishing, vishing, pretexting, and where agreed, physical access attempts. Every campaign is scoped, authorised in writing and bounded by rules of engagement set with you in advance.
Is this used to punish employees?
No, and we would advise against framing it that way — it suppresses reporting, which is the behaviour you most want to encourage. Results are reported in aggregate by default, and the useful metric is how fast people report, not how many clicked.
What do you measure?
Click and credential-submission rates, time to first report, the proportion of staff who report, and how your security team handled the reports they received. Process response matters as much as individual behaviour.
How often should we run campaigns?
Regularly and with varied pretexts. A single annual campaign measures how well people recognise last year’s email, not how they would handle a current one.
Often scoped together.
Internal Network Pentest
Assess what an attacker could achieve once inside your network.
Security Assessment
Comprehensive evaluation of your organisation’s security posture.
Incident Response
Rapid, expert-led response to contain and recover from security incidents.
Web App Pentest
Identify vulnerabilities in your web applications before attackers do.
Ready to secure your assets with Social Engineering?
Get in touch with DERISK to schedule an assessment or learn more about how our expert-led testing can strengthen your security posture.
Request a demo ↗