Target research
Built only from what is public.
- Staff, roles and reporting lines
- Suppliers, tools and shared platforms
- Addresses already in breach data
- Events and dates worth imitating
Anyone can write a campaign that fools people. The useful question is what happens next: whether the credential works, whether the second factor stops it, whether anybody reports it, and how long it takes. We run the campaign and then measure the chain behind it, and we report numbers by department rather than naming the people who clicked.
Somebody will click. In a large enough organization somebody always clicks, and a campaign whose only output is a percentage tells you something you already knew while making your staff feel tricked.
What matters is the chain behind the click. Did the credential they typed actually work? Did the second factor hold, or is it the kind that can be relayed? Did the payload run? Did anybody report it, and how long did that take, and did the report reach somebody who acted? Each of those is a control you can fix, and none of them is a person you need to blame.
Agreed in advance, in writing, with the categories we will not use set out just as clearly as the ones we will.
Built only from what is public.
From broad to narrowly targeted.
The part most exercises stop short of.
The number worth improving.
Where agreed. Usually the service desk.
On site, only if you ask for it.
Including the pretexts we will not use, which matters more than the ones we will.
From your own context rather than a template.
Over days rather than in one burst, so reporting can be measured.
The part that turns a statistic into a finding.
Numbers by department, and a short session for staff that is not a telling-off.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows MITRE ATT&CK, NIST SP 800-115 and OWASP, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our red teaming service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
No, and we would push back if you asked. Naming people turns the exercise into a disciplinary process, and the next time somebody clicks they will stay quiet instead of reporting it - which is the opposite of what you want. We report by department and by control.
Anything built on redundancy, bonuses, pay, disciplinary action, bereavement, health scares or a genuine current emergency. They work extremely well and they do lasting damage to how people feel about their employer. We agree the list in writing before anything is sent.
No. Training measures whether people can pass a quiz. This measures whether your controls hold when somebody is fooled, which is a different question and the one that decides the outcome.
It makes it harder and it does not make it pointless. Several common MFA implementations can be relayed in real time by a proxied login page, and part of the exercise is finding out whether yours is one of them.
With your agreement, yes, and it is often the most productive part. Password and MFA resets over the phone are a standard route into organizations with good email filtering.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.