Social Engineering & Phishing: What a Real Assessment Looks Like

Every technical control in a network can be perfectly configured and an organization can still be compromised in an afternoon, because the easiest way in rarely involves breaking anything, it involves asking, convincingly enough, for someone to open the door themselves.

What a real assessment tests

A social engineering engagement isn't a single blanket phishing email sent to everyone at once, that measures very little beyond who clicks links on a Tuesday. A useful assessment is scoped around specific, realistic scenarios:

• Targeted phishing (spear phishing) against a small set of high-value roles, finance, IT admins, executives, using pretexts built from information genuinely available about the organization, the same way a real attacker would research a target rather than guess.
• Vishing (voice phishing), calling the help desk or an employee directly to test whether identity verification procedures actually hold up under a plausible, mildly urgent pretext, not just a scripted one.
• Physical and badge-access testing, where relevant, whether an unfamiliar person carrying a box and a confident expression can walk into a facility unchallenged.
• Pretext email + credential capture, measuring not just who clicks, but who enters credentials into a fake login page afterward, a materially more useful signal than click rate alone.

Why click-rate metrics alone are close to useless

A low click rate on a single simulated campaign doesn't mean an organization is resistant to phishing, it more often means that specific email didn't happen to match what worked on that specific day. What actually matters is whether credential entry drops over successive, varied campaigns, and, more importantly, whether the technical and procedural backstops catch what training alone will never fully prevent. Multi-factor authentication that resists a real-time relay attempt, email filtering that catches lookalike domains, and a help desk trained to verify identity before a password reset all matter more than the training program's completion rate.

The technical controls that catch what people can't be trained to catch every time

• Phishing-resistant MFA, passkeys or hardware keys, not just SMS codes, which can be relayed or intercepted in a real-time phishing attack.
• DMARC enforcement, so lookalike or spoofed versions of your own domain can't reach a recipient's inbox convincingly, see our breakdown of SPF, DKIM, and DMARC for what "enforcement" actually requires versus monitoring-only.
• A help desk identity verification procedure that's actually followed under pressure, not just documented, this is precisely what a vishing assessment is designed to test empirically rather than assume.

What good remediation looks like

The output of a well-run assessment is a specific set of findings about which pretexts worked, which controls caught an attempt versus which ones didn't fire at all, and where the help desk or verification process has a real gap, not a shame list of who clicked. That's the same standard we hold every finding to across our penetration testing engagements: a finding is only useful if it comes with a concrete, verifiable fix attached, following the same structured methodology we use for technical testing.

If you're building out a broader security awareness program or want to know where your organization actually stands against this kind of attempt, our security consulting work covers both the assessment and the follow-through, including SANS's guidance on security awareness program maturity, a solid independent benchmark for what a mature program looks like beyond a single annual training video. For the attack this testing is most directly rehearsing against, see our piece on business email compromise.