Social Engineering Assessment
People are the most-attacked surface. We test yours safely and ethically — phishing, vishing and pretexting — to measure real human risk and the effectiveness of your awareness program.
What is Social Engineering Assessment?
People are the most-attacked surface, and awareness training is only as good as its results. We test yours safely and ethically — phishing, vishing and pretexting — to measure real human risk and give you metrics you can act on, not blame.
Attackers target people because it works, and no amount of technical control fully closes that gap — but you can measure it and shrink it. We run agreed, ethical scenarios across email, phone and pretext to see how staff respond under realistic pressure, then report the patterns: where people are vulnerable, where controls caught the attack, and where awareness effort will pay off. The goal is measurement and improvement, never individual blame.
A social engineering assessment also tests something purely technical controls can't reach: whether your combination of people, process and safeguards actually stops a human-targeted attack. A staff member may be fooled, but if MFA, filtering and a reporting culture catch it, the attack still fails. We measure the whole chain, so you invest in the link that's actually weak.
Social Engineering Assessment is a manual, exploit-driven assessment: real people attacking your target the way an adversary would, then proving each finding with a working proof of concept. It is not an automated scan with a logo on it — the point is to find and demonstrate the issues that actually put you at risk, and hand your team a clear plan to fix them.
Why it matters
Real adversaries don't follow a checklist — they pursue an objective and adapt. Testing controls in isolation tells you nothing about whether your people and detection would actually stop an intrusion in progress.
A social engineering assessment engagement replaces guesswork with evidence. Instead of hoping your controls hold, you get a ranked, reproducible picture of where they don’t — before someone hostile finds the same gaps.
Industries & use cases
Social engineering assessments suit organisations of any size, but especially finance, healthcare and any business where a single tricked employee grants access to sensitive systems or funds.
What we test
Manual, exploit-driven coverage focused on real impact — not scanner noise.
- Email phishing campaigns
- Voice phishing (vishing)
- Pretexting and impersonation
- Credential-capture scenarios
- Payload and awareness testing
- Metrics and remediation guidance
Signs you should run a social engineering assessment
If any of these apply, testing is overdue.
- Your staff are targeted by phishing or fraud
- You've had a near-miss or successful social-engineering incident
- You want to measure awareness-training effectiveness
- You handle funds or sensitive data staff can be tricked into exposing
- Compliance or insurance expects it
Common vulnerabilities we find
The issues that show up again and again in social engineering assessment — and the ones that actually get exploited.
Credential phishing
Staff entering credentials on a convincing lookalike.
Pretext-based access
Impersonation yielding information or access over phone or email.
Low reporting rates
Attacks that succeed because no one raises the alarm.
Missing technical safeguards
Absent MFA, weak email filtering or no reporting mechanism that would blunt a successful lure.
Over-trust of authority/urgency
Staff complying with 'IT support' or 'the CEO' without verification.
No verification process for requests
Sensitive actions taken on request without out-of-band verification.
Weak physical/reception controls
Tailgating and impersonation succeeding on site.
Slow escalation of reported attacks
Reports that are made but not acted on quickly.
Example attack chain
Real impact rarely comes from one bug — it comes from chaining several. A representative example:
Why choose webhook.press
Attacker mindset
We’re offensive security people who also build the free tools bug-bounty hunters use daily. We test the way real adversaries do — and prove it.
No scanner theatre
You get findings a human exploited and verified, ranked by real business risk — not an unfiltered tool dump padded to look thorough.
Fixed price, free retest
A clear quote after scoping, a report your team and auditors can use, and a free retest to confirm the fixes hold.
Our methodology
A structured, transparent process aligned to OWASP and PTES — with a named point of contact throughout.
Scoping & rules of engagement
We agree the exact targets, depth, timing and constraints for your social engineering assessment, and set clear rules of engagement so testing is safe and predictable.
Reconnaissance & mapping
We enumerate the full attack surface — endpoints, roles, technologies and trust boundaries — and threat-model where an attacker would focus.
Manual testing & exploitation
We attack by hand, verifying and chaining weaknesses into real impact. Automated tooling supports coverage; humans find the logic and authorization bugs it can’t.
Analysis & risk rating
Each finding is validated, rated by real business risk rather than raw scanner severity, and de-duplicated so you get signal, not noise.
Reporting
You receive an executive summary for leadership and a technical section with reproducible PoCs, evidence and concrete, stack-specific remediation.
Free retest
After you remediate, we re-test the closed findings to confirm they are actually fixed — at no extra cost.
What you get
Reproducible PoCs
Every finding ships with a working proof and step-by-step reproduction your engineers can replay and verify.
Risk-ranked findings
Prioritised by real business impact, so you fix what matters first instead of drowning in low-severity noise.
Actionable remediation
Concrete, stack-specific fixes and guidance — not generic “apply best practice” filler.
Free retest
We re-check the closed findings after remediation and confirm they’re resolved.
The report is written for two audiences at once: an executive summary that a non-technical stakeholder can act on, and a detailed technical section — findings, evidence, CVSS and reproduction — that your developers and auditors can use directly.
Manual testing, not just a scan
Automated scanners are fast and useful for coverage, but they only find patterns they already know, and they flood you with false positives. They cannot understand your business logic, chain several small issues into a breach, or tell you which alert actually matters. Our social engineering assessment is led by experienced testers who exploit findings by hand and rank them by the damage they’d really do — the difference between a 300-page tool dump and a short list of things worth fixing.
Standards & compliance
Our social engineering assessment reports are written to support the frameworks your auditors and customers care about — including SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and the EU’s NIS2 and DORA. Each engagement produces clear, independent evidence of testing with scope, methodology and findings documented the way assessors expect, so the same test both hardens your systems and helps satisfy your obligations.
Frameworks we follow
Recognised methodologies, adapted to your target — never a rigid checklist.
- OWASP — Web Security Testing Guide, ASVS and the API Security Top 10
- PTES — the Penetration Testing Execution Standard
- NIST SP 800-115 — technical guide to security testing
- OSSTMM — Open Source Security Testing Methodology Manual
- MITRE ATT&CK — to frame real-world adversary techniques
FAQ
Is this ethical and safe?
Yes — scenarios are agreed in advance, data is handled carefully, and the goal is measurement and improvement, not blame.
Do you name individuals?
No — we report aggregate metrics and trends, not individual shaming.
Is this ethical and safe?
Yes — scenarios and boundaries are agreed in advance, data is handled carefully, and results are reported as aggregate metrics.
Do you identify individuals?
No — we report trends and rates, not individual shaming.
Do you test phone and in-person, not just email?
Yes — vishing and physical pretexting are available where they fit your threat model and scope.
How do you keep it ethical?
Scenarios, boundaries and data handling are agreed in advance, and results are reported as aggregate metrics.
How long does a social engineering assessment take?
Most focused engagements run one to two weeks depending on scope; we agree the exact timeline during scoping.
Is a retest included?
Yes — after you remediate, we re-check the closed findings to confirm they’re fixed, at no extra cost.
How do you price it?
Per engagement, based on scope and depth — you get a fixed quote after a short scoping call. No cookie-cutter packages.
Why teams trust our social engineering assessment
Aligned to recognised standards
Testing follows OWASP, PTES, NIST SP 800-115 and MITRE ATT&CK, and reports support SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIS2 and DORA.
Every engagement includes
Reproducible PoCs, risk-ranked findings, concrete remediation, a named point of contact, a free retest, and a summary letter of attestation.
Confidential by default
Work is covered by an NDA, scoped with clear rules of engagement, and data is handled with care throughout — including residency requirements.
Sample report available on request — see our reporting format and depth before you commit. Ask for a sample →
Get a quote for Social Engineering Assessment
Tell us about the target — we’ll come back with scope and a fixed price. Manual, exploit-driven testing with reproducible proof and a free retest.