Your People Are Your Largest Attack Surface. We Test Them.
Deepfake voices, CEO fraud via phone, AI-generated voice calls. Attackers are calling now. Sectricity tests whether your people hold the line before a real attacker finds out.
People are the weakest link. And the strongest when trained.
Your firewall cannot stop an attacker who calls
Social engineering tests what technical tools cannot measure: human behaviour under pressure
Where companies have blind spots
Phishing training that only measures clicks but not how employees respond to a call from the IT helpdesk or the CEO
What Sectricity uncovers
Realistic vishing scenarios built from OSINT about your organisation, sector and staff
Where companies have blind spots
The assumption that technical security also stops human manipulation
What Sectricity uncovers
Evidence of which employees, departments or processes are vulnerable to social engineering
Where companies have blind spots
No insight into how far an attacker gets by impersonating a supplier, IT helpdesk or executive
What Sectricity uncovers
Documented attack chains from first contact to successful manipulation, with a learning point per scenario
Where companies have blind spots
A one-off awareness session forgotten within three months
What Sectricity uncovers
Behaviour-focused debrief with concrete recommendations per audience, ready for follow-up training
What a social engineering assessment covers
From vishing to physical infiltration
Vishing (voice phishing)
Realistic phone-based attacks where our testers pose as IT helpdesk, supplier, auditor or executive. With and without AI voice tools.
Smishing (SMS and WhatsApp)
Targeted messages enticing employees to click a link, hand over credentials or execute a fraudulent payment instruction.
Mystery guest and impersonation
Our tester visits your premises and attempts to access restricted zones, systems or confidential documents via impersonation or tailgating.
USB drop and baiting
Infected USB drives are left around your premises. We measure how many employees connect them and what data would be accessible.
OSINT and preparation
Every test starts with open source intelligence about your organisation: LinkedIn, job postings, press releases and public documents used for targeting.
Debrief and recommendations
Documented report per scenario with risk assessment, attack timeline and concrete recommendations for training and process adjustment.
How a social engineering test runs
Realistic, controlled and fully documented
1. Scope and authorisation
We define the scope together: which employees, departments, channels and scenarios. Everything runs with explicit authorisation from the client.
2. OSINT and scenario development
Our testers gather publicly available information about your organisation and build credible scenarios based on real context.
3. Execution of attacks
Vishing calls, smishing, mystery guest or USB drop are executed according to the agreed test plan.
4. Documentation and analysis
Each scenario is documented with recordings, screenshots and attack timelines. Results are analysed per employee, department and attack type.
5. Debrief and learning points
Personal presentation of results to the client, with recommendations for immediate action and a proposal for follow-up training.
Who is a social engineering test for?
Every organisation with employees has a human attack surface. We measure how large it is.
CISOs and Security Managers
You want to know whether your employees can withstand targeted attacks. A social engineering test gives you concrete data and an action plan for training.
Compliance and NIS2 leads
NIS2 requires organisations to actively manage risks related to human behaviour. A documented social engineering test delivers the evidence for your auditor.
Companies with high-risk roles
Your employees work with financial data, customer records or access to critical systems. A people-focused attack is the shortest path to a data breach.
Frequently asked questions
Do you know who is calling your employees this afternoon?
Book a social engineering test before a real attacker does. Free scoping call within 1 business day.