Home / Knowledge hub / Social engineering test
Knowledge hub
Social engineering test
Checking whether people can be talked into handing over access or information.
What it means
A social engineering test is an authorised exercise that checks whether your people can be talked into giving away access or information. Instead of a flaw in software, it tests a flaw in human judgement, using phishing emails, phone calls, messages or even visits in person.
NIST defines social engineering as an attempt to trick someone into revealing information or taking an action that helps an attacker. A test copies those tricks under controlled conditions, then records who fell for what, so the business can learn from it.
Why it matters
Many breaches start with a person, not a vulnerability. A convincing message that gets a password, a phone call that resets an account, a stranger who is let through a door. Strong technical controls count for less if a staff member can be persuaded to bypass them.
Testing shows how big the gap is, and which controls work. A phishing test that few people report suggests a reporting problem as well as a training problem. The results are used to improve training, procedures and technical backstops, not to punish individuals.
How it shows up
Common forms are phishing emails, voice calls, text messages and physical visits. The tester builds a believable story, called a pretext, and measures what happens: who clicked, who entered a password, who reported it. Strong programmes also test the technical backstops, such as multi-factor sign-in.
Set rules first. Get written approval from leaders, agree what is off limits, and involve legal and HR, because tests deal with people's data and feelings. The mistakes repeat: shaming staff, testing once a year and calling it done, or measuring only click rates while ignoring how quickly the first person reported it.
Questions people ask
Social engineering test, answered
Is a social engineering test the same as a phishing simulation?
A phishing simulation is one kind of social engineering test. The wider term also covers phone calls, messages and in-person attempts to get in or get information. Each uses a different channel and tests a different habit.
Do we need permission before running one?
Yes. You need written approval from senior leaders and often legal and HR. Without it, the exercise can cause real harm, from privacy complaints to staff distress and legal trouble.
Should we tell employees about it?
Not the details of a specific test, or it would not show real behaviour. But do tell them that testing happens as a policy, and explain afterwards what it was for and how it will be used.
What do we do with the results?
Use them to fix systems and training, not to blame people. Look at which technical controls caught the attempts and which did not, and make reporting easy and rewarded, so people speak up quickly.
Can technical controls reduce the damage?
Yes. Multi-factor sign-in, email filtering, and limited access mean one person's mistake does not hand over everything. Good design assumes some people will be tricked and limits what that costs.
Sources
Where this comes from
Related
Terms that sit next to this one
Social engineering
Manipulating people, not software, into giving up access or information.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Business email compromise
Fraud using a hacked or faked work email to redirect payments or data.
MFA fatigue
Spamming approval prompts until a tired user taps accept.
Red team
A simulated adversary given a goal and left to reach it however they can.
What can people still be talked into?
Social engineering aims at people, while our work is on the application side: finding vulnerabilities in web apps and their APIs and proving them. A strong app limits the damage one mistake can do. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.