1
Scope and authorize
We agree targets, volumes, pretext themes and every message before anything is sent, with written authorization in place.
People & premises
Social engineering
Authorized phishing, vishing and pretext campaigns that measure what your people actually do under realistic pressure — and, more usefully, how quickly someone reports it and what happens next.
8
areas covered
5
stages, scoping to retest
In-house
testers, never subcontracted
portal.cyberlysecure.com/acme-health/coverage
Acme Health — Test coverage4 practices · 16 services · one team
In-houseWeb app
API
SaaS
Mobile
Client-side
External
Internal
Segment test
Wireless
Vuln. assessment
Cloud config
Hardware & IoT
AI & LLM
Social eng.
Physical
Red team
ApplicationsNetworkCloud & devicesPeople & premises
6 in scope · one team · one report
In-house testers 0 subcontracted
Every surface one team
What this is
What the test covers.
Awareness training tells you what your people know. A controlled campaign tells you what they do on a busy afternoon, and whether your process catches what an individual misses.
Every pretext is approved by you in writing before it is used. We measure reporting as carefully as clicking, because reporting speed is what actually limits the damage — and nobody is named to embarrass them.
PTES social engineering guidance NIST SP 800-115 MITRE ATT&CK initial access techniques
What we test
- Email phishing: credential capture and, where authorized, attachment or link payloads
- Voice pretext calls to helpdesk, reception and named departments
- SMS and messaging pretexts
- Multi-factor fatigue and relay scenarios, only where explicitly authorized
- Physical media drops on site, where in scope
- Reporting rate and time-to-report, not just click rate
- What your helpdesk will do for a convincing caller — reset, enrol or divert
- How your controls handled the message before a person ever saw it
How it runs
From scoping call to retest, here’s what happens.
Typically one to three weeks, depending on channels and number of waves.
2
Build the pretext
Campaigns are written around your environment and calendar so they are realistic rather than generic.
3
Run it safely
Credentials are never retained, payloads are benign, and anything that looks like real distress ends the interaction.
4
Measure the response
We record who clicked, who submitted, who reported, how fast, and what your team did with the report.
5
Report and debrief
Results are reported at team level with practical fixes — and, if you want it, a session for the people involved.
What it surfaces
The kind of thing this test tends to find.
Real examples of what this engagement uncovers — anonymized, and never every time. What matters is that you find out before somebody else does.
Reporting that is far slower than clicking, leaving a long unnoticed window
Helpdesk processes that will reset a factor for a confident stranger
Filtering that lets a plainly hostile message reach every inbox
A reporting button nobody uses because nothing visible happens afterwards
Departments under time pressure being measurably easier to deceive
Frameworks this test supports
Testing that counts toward your framework.
These programs call for this test, or their assessors and your customers expect it. If one of them is on your desk, readiness and testing come from the same team.
ISO 27001
Awareness controls in the people theme carry more weight when you can show how staff respond to phishing, not only that training was delivered.
ISO 27001 readinessHITRUST
Phishing exercises support the security awareness requirement statements and show that training actually changes behavior.
HITRUST readinessCMMC
Security awareness training is a Level 2 requirement, and Level 3 adds training focused on social engineering and advanced threats; a phishing exercise shows whether that training changes behavior.
CMMC readinessFedRAMP
The guidance also includes an external-to-corporate vector, which reaches the people who administer your service; a phishing exercise measures that exposure.
FedRAMP readinessHIPAA
Phishing is a leading route into healthcare networks; testing your workforce shows whether the security awareness and training safeguard is working.
HIPAA readinessNIST CSF
Gives real evidence for awareness and training outcomes beyond course-completion records.
NIST CSF readinessSecurity program
Measures how well awareness training and identity verification procedures hold up against realistic phishing and pretexting.
Security program readinessIncident response
Phishing and pretexting campaigns test the front door most incidents come through, and show whether staff report suspicious messages to the people your plan says should receive them.
Incident response readinessZero Trust
Puts phishing-resistant MFA, help-desk identity verification and user reporting to the test against the attacks they exist to stop.
Zero Trust readinessSecurity awareness
Phishing, vishing and pretexting campaigns run by an independent tester show how your people respond to realistic lures and give your awareness program a baseline to measure progress against.
Security awareness readiness Getting started
What you get, and what we need from you.
What you get
- Technical report — Every finding, the evidence behind it and clear guidance your engineers can act on.
- Executive summary — Your risk explained in plain language for leadership and the board.
- Attestation letter — Signed confirmation of testing to hand your auditors.
- Readout call — A walkthrough with the people who tested your systems.
- Retest — Confirmation your fixes worked, documented for whoever needs to see it.
What we need from you
- Written authorization from someone who can give it for your people
- A target list and any individuals to exclude
- Allow-listing decisions: do you want controls tested, or people
- A named contact who will know the campaign is live
Missing something on this list? Bring it to the call — we scope around what you have.