Social Engineering Testing: Realistic Attacks Within Ethical Limits

Why people remain the main target

Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches. Email is one channel among several: 41% of social engineering breaches involved other channels, such as phone calls and social media.

The money involved is large. Business email compromise cost victims about $3 billion in 2025, according to the FBI's Internet Crime Complaint Center.

Two recent cases show how these attacks work. In 2024 a finance employee in Arup's Hong Kong office joined a video call with what looked like the company's chief financial officer and colleagues. Every other participant was a deepfake, and the employee made 15 transfers totalling about $25 million (CNN). In April 2025 attackers reportedly talked IT help desk staff at Marks & Spencer into giving them access. After the ransomware attack that followed, the retailer reported about £102 million in one-off costs for the half year, and its statutory profit before tax for that period fell from £391.9 million to £3.4 million.

What AI changed

• Phishing emails are now fluent and company-specific in any language, and take seconds to write.
• A short public recording, such as a conference talk or an earnings call, can be enough to clone a voice for a phone pretext.
• Deepfake video calls, as in the Arup case, put a familiar face on the request.
• Attackers research targets at scale from company websites, professional networks and job postings.

Clumsy wording is no longer a reliable warning sign, so training should teach people to verify unusual requests through a second, known channel.

Techniques we test

Phishing

Campaigns built around the tools and suppliers your company actually uses: login pages, MFA push fatigue, OAuth consent requests and QR codes. We measure who opened, clicked and entered credentials, and above all who reported the email and how quickly the security team responded.

Phone pretexting and help desk tests

Calls to the help desk asking for a password or MFA reset on behalf of an employee, and calls to employees from someone posing as IT. This is the route reportedly used against Marks & Spencer, and it tests whether identity checks hold up under time pressure and a plausible story.

Text messages and collaboration apps

SMS lures and messages in Teams or Slack sent from outside accounts made to look like internal IT or management.

Business process pretexts

A supplier asking to change bank details, an auditor requesting data, an executive pushing for an urgent payment. These tests check approval procedures in finance and operations.

Physical access

Following staff through secured doors, posing as a contractor or courier, cloning access badges. Physical tests run only at sites named in a written authorization, and testers carry that letter with them.

The ethical limits

A social engineering test examines procedures and controls. Employees are its subjects, so it must not embarrass or harm them.

Consent and authorization

An executive with the authority to approve the test signs it. Legal and HR are informed before the test starts. A small control group knows the dates and can stop the test at any moment. Individual employees are told afterwards. This keeps the test realistic, and consent comes from the organization.

Rules we keep

• Pretexts stay professional. We leave out anything about family, health, layoffs or bonuses that could cause real distress.
• We contact employees only through work channels, unless the client authorizes something else in writing.
• Captured passwords are used only within the agreed scope, appear in the report only in redacted form, and the affected accounts are reset after the test.
• Testers stop the moment security staff challenge them during a physical test and show the authorization letter.
• Rules of engagement account for local laws on call recording and impersonation, which differ between countries and states.

Results without blame

By default we report results by department or role, without naming individuals. After the test, employees receive a short explanation of what happened and what to look for next time, and the people who reported the attempt are recognized. A rising reporting rate is a useful sign that the program works.

How a test runs

1. Scope and authorization. Targets, techniques, dates, the control group and the conditions for stopping.
2. Reconnaissance. Public sources only: structure of the organization, email format, suppliers and the tone of internal communication.
3. Pretext design. Every scenario is approved by the control group before use.
4. Execution. Monitored in real time, with a stop procedure ready.
5. Debrief and report. What worked, which controls held, and the process changes we recommend.
6. Retest. A follow-up after training or process changes to measure the improvement.

Controls that make these attacks fail

• Verify any change of payment details, any credential reset and any urgent request from an executive through a second, known channel.
• Base help desk identity checks on something an attacker cannot find online, such as a callback to the number on file or manager approval. Since a video call can be faked, it should not be the only check for MFA resets on privileged accounts.
• Move privileged and remote-access accounts to phishing-resistant MFA (our article on stealer logs explains why session controls matter too).
• Put a one-click report button in the mail client and make sure someone answers the reports quickly.
• Run short, regular training built on the results of your own tests.

Social engineering tests are part of our penetration testing and red team work, with rules of engagement agreed with your management and HR before the first message goes out.