Social Engineering Testing

What Social Engineering Vectors Does Risk Crew Test?

Phishing (Email Attacks)
Simulated spear-phishing campaigns designed to test link clicking, credential harvesting, and malicious attachment execution.

Vishing (Voice Call Attacks)
Targeted phone calls impersonating IT support, executives, or external vendors to trick staff into revealing sensitive passwords or access codes.

Smishing (SMS & Messaging)
Text message simulations targeting corporate mobile devices with urgent links or false MFA prompts.

Impersonation & Physical Pretexting
On-site social engineering where testers impersonate delivery personnel, contractors, or auditors to gain physical entry to restricted areas.

On-Site Tests:

Onsite social engineering tests are designed to evaluate an organisation's security posture against social engineering attacks that occur on-premises. Here are some types of onsite social engineering tests that organisations can perform:

Tailgating: The social engineer attempts to follow an employee through a secure door or checkpoint without proper authorisation.

Badge cloning: The social engineer attempts to gain access to secure areas by copying an employee's ID badge.

Physical security bypass: A social engineer attempts to go around physical security measures. Examples of these measures include cameras and security guards. This is done to gain access to secure areas.

Off-site Tests:

Offsite social engineering tests evaluate an organisation's security posture against remote attacks, such as phone or email attacks. They involve a simulated attack against the organisation's employees or infrastructure without physical presence. Some types of offsite social engineering tests include:

Phishing emails: The social engineer sends fraudulent emails that appear to be from a reputable source, to trick the recipient into divulging sensitive information, such as login credentials or financial data.

Vishing: The social engineer makes phone calls, posing as a trusted third party, to gain access to sensitive information.

Smishing: The social engineer sends text messages that appear to be from a reputable source, to trick the recipient into divulging sensitive information.