Penetration Testing/Social Engineering Testing

Social Engineering

Social engineering penetration testing that tests people and process, not just inboxes

Phishing, phone pretexting and, where agreed, physical access tests built around how a real attacker would target your organization. You get evidence of what worked, what was reported, and the process fixes that close the gap.

Targeted phishing simulation with researched pretexts
Vishing and help desk pretext calls
Physical access tests, only where agreed in writing
Results that measure reporting and response, not only clicks

Scope my phishing test See how we work ↓Talk to an expert →

The credentials behind every engagement

2026 CyberSecurity Breakthrough Awards winner

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026

Key terms: What is vishing?

Trusted by security teams at

See it in action

Six channels. One payment approved.

We run an agreed campaign at one objective across email, SMS and voice, measure who reported it, then repeat it after training.

Approval · Week 1Research · Week 2Campaign · Week 3Debrief · Week 5Repeat · Week 18

ApproveResearchCampaignDebriefRepeat

01Six channels, one objective, mapped to MITRE ATT&CK

02The objective, and the call that reached it

03Across the campaign

CHANNELAIMED ATFELL FOR ITREPORTEDSHOWING · REPEAT CAMPAIGN

Spear phishing email

T1566.002

Finance

28%8%

14%61%

QR code in a benefits notice

T1598.003

All staff

22%7%

6%48%

SMS from “IT security”

T1566

Field sales

19%6%

4%39%

Help desk call: reset my MFA

T1566.004

Help desk

2 of 30 of 3

0 of 33 of 3

MFA push fatigue

T1621

Engineering

1 of 40 of 4

1 of 44 of 4

Cloned-voice CFO call

T1683.002T1684.001

Accounts payable

1 of 20 of 2

0 of 22 of 2

OBJECTIVE AGREED WITH YOU

A payment approved, no callbackNot reachedReached · Week 3RepeatingStopped

Accounts payable · desk phone

Voice channelCalls run on day 4 of the campaign

Dana Ruiz · CFO

Incoming call · Week 3Incoming call · Week 18

SIMULATED VOICE CLONE

I’m about to board. Please release the Halvorsen payment today and I’ll approve it tonight.

Understood, sending it now.

COMPLIED · STOPPED BEFORE RELEASE

I’ll call you back on the number on file.

CALLBACK · REPORTED TO SECURITY

DEBRIEF AND TRAINING · WEEK 5Callbacks to the number on file, help desk identity checks, and a report button on every phone.

FELL FOR IT

–21%6%

First campaignRepeat, after training

REPORTED

–9%52%

First campaignRepeat, after training

ESCALATED IN 1 H

–3%41%

First campaignRepeat, after training

Mapped toMITRE ATT&CKNIST SP 800-53 AT-2(3)PCI DSS v4.0.1 Req. 12.6.3.1Agreed in writing first

Swipe to see the full exhibit →

The attacker picks the channel

Email got the most scrutiny. The calls and the cloned voice got the least, and went furthest.

Reports beat clicks

What matters is how many people report an attempt, and how fast security hears about it.

Fix the process, then repeat

Callbacks and help desk identity checks closed the voice routes in the repeat campaign.

Read this exhibit as text

We agree the campaign and one objective with you in writing: a payment approved without a callback. All rates below are illustrative.
Spear phishing email to finance (MITRE ATT&CK T1566.002): 28% fell for it and 14% reported it. In the repeat campaign, 8% fell for it and 61% reported it.
QR code in a benefits notice to all staff (quishing, T1598.003): 22% fell for it and 6% reported it. Repeat: 7% and 48%.
SMS from a fake IT security team to field sales (T1566): 19% fell for it and 4% reported it. Repeat: 6% and 39%.
Help desk call asking to reset a user’s MFA (T1566.004, spearphishing voice): 2 of 3 agents complied and none reported it. Repeat: none complied and all 3 reported it.
MFA push fatigue against engineering (T1621): 1 of 4 approved a push and 1 of 4 reported it. Repeat: none approved and all 4 reported it.
A simulated cloned-voice call from the CFO to accounts payable (T1683.002, audio-visual content; T1684.001, impersonation) asks for a payment to be released today. 1 of 2 complied and neither reported it; the test was stopped before any payment was released. The objective is reached in week 3.
Debrief and training, week 5: callbacks to the number on file, help desk identity checks, and a report button on every phone.
Repeat campaign, week 18: neither accounts payable clerk complies; each call is met with a callback to the number on file and reported to security. Across the campaign, the share who fell for it drops from 21% to 6%, reporting rises from 9% to 52%, and escalation within one hour rises from 3% to 41%. Voice clones are simulated only with written approval.

Source: ioSENTRIX social engineering methodology; MITRE ATT&CK Enterprise. Illustrative campaign and rates at a fictional company, not client data. Voice clones are simulated only with written approval.

The short answer

What is social engineering penetration testing?

Social engineering penetration testing is an authorized test of how people and processes respond to manipulation. Testers use phishing emails, phone pretexting (vishing) and, where agreed, attempts to enter buildings, to see whether staff disclose information, hand over access or report the attempt. It shows the human routes into your organization.

A phishing simulation platform sends templated emails and counts clicks. A social engineering assessment is built like a real attack: pretexts researched from public information, calls to your help desk, and follow-through on whatever access a click or call gives. It tests the process behind the person, such as identity checks and reporting.

At ioSENTRIX, social engineering testing is carried out by certified testers at a CREST-accredited firm under written rules of engagement, with techniques mapped to MITRE ATT&CK T1566 Phishing and T1598 Phishing for Information.

You need social engineering testing if

Your help desk can reset passwords or MFA over the phone
You want evidence that your security awareness program works
You need to know whether staff report suspicious emails and calls
Your pentests and red team exercises do not yet cover the human route

What we test

Four ways in, tested with your agreement

Every campaign is agreed in writing first. Most social engineering assessments cover these four areas.

Phishing simulation

Targeted emails built from what an attacker could learn about you.

Credential harvesting pages
Link and attachment pretexts
Lures aimed at executives and finance
Reporting rate and time to report

Voice

Vishing

Phone pretexts aimed at the people who can grant access.

Help desk password and MFA reset requests
Callers posing as IT, vendors or executives
Requests for sensitive information
Identity verification checks

Physical

Physical access, where agreed

Whether someone without a badge can get in and plug in.

Tailgating at controlled entrances
Badge and visitor process checks
Unattended devices and network ports
Documents left in the open

Process

Process and response

Whether your controls work after the first mistake.

Reporting and escalation paths
Security team response to reported attempts
MFA and sign-in protections after a click
Awareness gaps by team

Methodology

How we test: example test cases

A sample of the scenarios in a typical social engineering assessment. Your scope and approvals decide the full list.

T1566.002

Spearphishing link

A targeted email leads to a cloned sign-in page. We record who submits credentials and whether MFA stops the attacker.

T1566.001

Spearphishing attachment

A harmless, tracked attachment tests whether email filters block it and whether staff open or report it.

T1566.004

Help desk vishing

A caller posing as an employee asks the help desk to reset a password or enroll a new MFA device.

T1598.004

Information gathering by phone

Pretext calls try to collect internal names, processes or system details that would help a later attack.

T1621

MFA prompt fatigue

Where agreed, using credentials captured in the campaign, we test whether repeated MFA prompts get approved.

T1684.001

Deepfake voice simulation

Only with your written approval, a cloned-voice call posing as an executive asks for an urgent payment. We test whether staff call back on the number on file and follow your payment approval controls.

T1598.003

QR-code phishing (quishing)

A QR code in an email or printed notice opens a sign-in page on a personal phone, away from email link scanning. We record who scans, who submits credentials and who reports it.

T1583.001

Business email compromise (lookalike domain)

An invoice or bank-detail change request arrives from a lookalike vendor domain. We test whether your payment verification steps and email authentication controls catch it before money moves.

CA-8(3)

Physical entry

Where agreed, we test whether a tester can tailgate into the building or reach an open network port.

Sample finding

What a finding looks like in our report

An illustrative example in our report format. Not client data.

Finding 01 · IllustrativeHigh

A help desk caller resets MFA for a finance user using only public information

MITRE ATT&CK T1566.004 Spearphishing Voice · NIST SP 800-53 AT-2(3) Social Engineering and Mining

What we found

The tester called the help desk as a finance employee with a new phone. The agent asked for the employee’s name, job title and manager, all found on the company website and a public professional profile, then removed the old MFA device and enrolled the tester’s.

Impact

Anyone who can research an employee online can take over their account, including access to payment systems.

How to fix it

Verify identity for MFA and password resets through a channel the caller does not control, such as a callback to the number on file or manager approval. Notify the user whenever an MFA device changes, and add the scenario to help desk training.

What you get

What you get from every social engineering assessment

Not a click-rate chart. Evidence of what worked and the process fixes that stop it.

Campaign results with evidence

For each scenario: what was attempted, how people and processes responded, and what access it would have given an attacker.

Process findings and fixes

Findings focus on the controls behind people, such as identity checks, reporting paths and MFA, with remediation guidance for each.

Debrief and awareness input

We walk your team through the results, and the scenarios that worked can feed your security awareness training.

ioSENTRIX sample penetration test report cover

See how we write findings before you talk to us

A redacted sample penetration test report (web application): finding write-ups, proof-of-concept evidence and remediation. No form required.

Download the sample report (PDF) →

Verified reviews

What security leaders say about working with us

★★★★★

“Unlike other providers, Omair and his team truly dive deep into our infrastructure, delivering findings that go well beyond the surface level. Communication is direct and seamless.”

Jesus B.

Cybersecurity Manager, Banking

Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX’s ability to independently validate the security of our customer-facing product.”

Zeehasham R.

Data Scientist, Security Operations · Fortune 500 insurer

Verified Clutch review ↗

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.

SVP, Chief Information Security Officer

Verified G2 review ↗

How it works

How a social engineering assessment works

Four steps, so you know what happens and what you get.

Scope and approvals

We agree scenarios, targets and what is off limits, with written sign-off from the people who need to know.

Before testing

Research and pretexts

We gather the public information an attacker could use and build pretexts for your approval.

Before launch

Campaign

Emails, calls and any agreed physical tests run within the approved window.

Most of the engagement

Report and debrief

Results, evidence and process fixes, walked through with your team, with a repeat campaign available.

At close

Reply in under an hour → scoping call → fixed quote in writing → campaign window agreed by scope → report, debrief and repeat campaign

How we compare

Not a phishing template library.

What a social engineering assessment covers compared with the usual alternatives.

ioSENTRIX social engineering test

Automated phishing platform

Awareness training only

Scenarios

Researched pretexts across email, phone and agreed physical access

Templated emails from a library

None; content only

Help desk and process

Tested with realistic calls

Not tested

What is measured

Credentials, access gained, reports and response

Clicks and form submissions

Course completion

Follow-through

Shows what access a click or call would give

Stops at the click

Not applicable

Output

Evidence, process findings and fixes

Dashboard of rates

Completion records

Scope my phishing test

Scope and price

What affects the scope and price of social engineering testing

Social engineering engagements are priced on effort. These are the decisions that move the quote.

What moves the quote

01How many people or teams are targeted
02Which channels are in scope: email, phone, physical
03How targeted the pretexts are: broad, or researched for specific roles
04How many sites, if physical testing is agreed
05Whether captured access is followed through to show impact
06Repeat campaigns to measure change over time

Read: What is phishing? How to recognize and report phishing emails →

What we need from you to start

Written authorization from someone who can approve testing of staff
The target list, or the teams and roles in scope
People, topics and pretexts that are off limits
Email allow-listing, if you want to test people rather than filters
A contact who can confirm the test if staff escalate

Scope my phishing test

Track record

Numbers you can check

Ratings you can verify on G2 and Clutch.

4.9 / 5

on G2 from 12 verified reviews

5.0 / 5

on Clutch, Premier Verified

2017

founded; CREST-accredited, ISO 27001 certified, SOC 2 Type 2 attested

Independently verified

Credentials held by the firm

Every engagement runs inside a company whose methods and own security are checked by outside bodies.

CREST-accredited for penetration testing

CREST assesses the firm's testing methodology, quality assurance and handling of client data.

View our CREST listing →

SOC 2 Type 2 attested

An independent auditor tested our own security controls over time.

Request the SOC 2 report →

ISO/IEC 27001 certified

Our information security management system is certified to ISO/IEC 27001.

View in our trust center →

Recognized independently

Penetration Testing Solution of the Year, 2026 CyberSecurity Breakthrough Awards. G2 High Performer, Fall 2026.

Award announcement →See our G2 reviews →

Founded in 2017.

For your buying team

Everything your reviewers will ask for

Security, finance and procurement each need something different. Forward this page, or pull what each reviewer needs.

For security

Sample report

See exactly what you get: findings, proof of concept, fixes and retest results.

Download the sample report (PDF) →

For vendor risk

Trust center

Our SOC 2 Type 2 report and security documentation for your vendor review.

Open the trust center →

For procurement

Procurement pack

Master services agreement, sample statement of work, certificate of insurance and W-9.

Request the procurement pack →

For your team

Share this page

Send the link to the people who need to sign off.

Who you work with

Who does the work

Senior security engineers do the hands-on work and write up the results, so the person who found an issue explains it to your team.

Certified engineers

Each engineer holds one or more of OSCP, OSWE, OSCE, CISSP, CISA or AWS security certifications.

Accredited firm

ioSENTRIX is CREST-accredited for penetration testing, ISO/IEC 27001 certified and SOC 2 Type 2 attested.

Since 2017

Founded in 2017, with security work for Fortune 100, financial services, insurance and SaaS companies.

Ready to see how your people and processes hold up to a real pretext?

We reply in under an hour · no sales pitch

Scope my phishing test

Standards

Frameworks we test and map to

◆MITRE ATT&CK T1566 Phishing◆MITRE ATT&CK T1598 Phishing for Information◆NIST SP 800-53 Rev. 5 AT-2(3) and CA-8(3)◆PCI DSS v4.0.1 Requirement 12.6.3.1◆ISO/IEC 27001:2022 Annex A 6.3◆NIST CSF 2.0 PR.AT

FAQ

Frequently asked questions

Is social engineering testing legal?

Yes, when it is authorized. Every engagement starts with written authorization from someone who can approve it, and rules of engagement that set targets, pretexts and limits. We recommend involving HR and legal before a campaign, especially for phone and physical tests.

Do you do physical social engineering?

Yes, where it is agreed in writing. Physical tests can include tailgating, badge and visitor process checks, and attempts to reach unattended devices or network ports. Each test has a named contact on your side who can confirm it is authorized.

Does PCI DSS require phishing testing?

PCI DSS v4.0.1 Requirement 12.6.3.1 requires security awareness training to cover phishing and related attacks and social engineering, and Requirement 5.4.1 requires mechanisms that detect and protect personnel against phishing. Phishing simulations are not named as a requirement, but they are a common way to show the training and controls work.

What happens if an employee reports the test?

That is a good result, and we record it. Your nominated contact confirms the test is authorized if staff escalate, and the report shows how quickly attempts were reported and how your security team responded.

How long does a social engineering assessment take?

Most assessments run days to weeks, depending on the channels, the number of targets and the approvals needed. We reply in under an hour during US business hours, and the scope, timeline and fixed quote follow the scoping call.

Resources

Go deeper before you scope a test

Practical guides from our testers on the questions buyers ask most.

Guide · 7 min read

What is phishing? How to recognize and report phishing emails?

A successful phishing attack can cause a ripple effect on organization security controls. Learn what phishing is and how to recognize and report…

Read the guide →

Guide · 7 min read

Red Team vs Penetration Testing vs Vulnerability Scanning

Learn the difference between red teaming, penetration testing, and vulnerability scanning, including their goals, scope, methods, and when to use…

Read the guide →

Guide · 6 min read

Security Awareness And Training in 27001 Certificate

The main goal of the ISO 27001 Security Awareness Training Policy is to make sure that all staff members are given the necessary training on…

Read the guide →

Keep exploring

Related services

HubAll penetration testing services ServiceRed team services ServiceSecure code and security awareness training

Ready when you are

Find out what an email or a phone call could get an attacker

Tell us which teams and channels you want tested. We will agree scenarios and limits in writing and send a fixed quote based on effort.

We reply in under an hour · Fixed quote in writing before work starts · Your details are never shared