Social Engineering and Physical

Test your people and your doors.

Phishing, vishing, pretexting and covert entry under agreed rules. Every contact is logged for your review.

From a name to the server room.

Five steps from open sources to the debrief, under agreed rules.

  1. Profile the targets

    Open-source intelligence builds the pretexts, within the agreed rules.

  2. Run the campaigns

    Phishing, vishing and pretexting are measured, not just sent.

  3. Approach the site

    Badge cloning and tailgating test the controls that guard the doors.

  4. Reach the objective

    Access to the agreed objective is documented in photo and video.

  5. Debrief the controls

    Facilities and security see the gaps control by control.

What this engagement covers

When you need it

  • After awareness training
  • Before opening a new site
  • As a red team component

What we do

  • OSINT profiling
  • Targeted campaigns
  • Badge cloning and tailgating
  • Objective access

What you get

  • Campaign metrics
  • Photo and video evidence
  • Control-by-control gaps
  • A debrief with facilities and security

How it runs

  • Duration: Validate operations run longer than an Assess engagement and are quoted per objective.
  • What we need from you: Agreed rules for every contact, a White Cell contact, and facilities and security at the debrief.

Standards

  • MITRE ATT&CK Initial Access

Frequently Asked Questions

What is in scope?
Phishing, vishing, pretexting and covert entry, each under rules we agree before any contact is made.
How are staff protected?
Every contact is logged for your review, the rules of engagement fix stop conditions, and the results are reported control by control.
Can this run inside a red team?
Yes. It runs as a red team component as well as a standalone test, and it maps to MITRE ATT&CK Initial Access.

How We Work

Eight steps from the first call to the closure letter. Every engagement follows them.

  1. Scoping call
  2. Rules of engagement
  3. Threat model
  4. Execution
  5. Analysis
  6. Readout
  7. Remediation support
  8. Retest
Read the full lifecycle

Ready to scope an engagement?

Tell us the asset and the decision the test should inform.

Scope a call