Social Engineering

Your staff members are the first line of defence against attackers, and it is becoming more and more common for attackers to simply phone a company and trick a staff member into giving them access to a customer or staff account, or other valuable system. This is known as social engineering, and is becoming increasingly prevalent as an attack vector.

Get Instant Online Quote
Social Engineering Reporting Software

The basics

What is Social Engineering Penetration Testing?

Social engineering is a simulated attack against your staff, which takes place either over the phone, via your helpdesk solution or via your webchat solution. The purpose of the simulation is to attempt to gain access to valid customer accounts, or to trick the staff member into divulging sensitive information.

Our testers will enumerate the potential attack surface for social engineering, carry out research into your business, the targeted staff members, and your customers prior to launching the simulated attack.

Social Engineering Penetration Testing
Speech Bubble with Padlock

Testing Benefits

What are the benefits of Social Engineering Pentesting?

As with more traditional types of security assessment, the benefit of social engineering is that it enables you to safely identify potential gaps in your security posture, and address those gaps before attackers exploit them in the real world.

Find out how well aware of potential threats your staff are, and identify gaps in your processes which could allow attackers to breach your organisation via a social engineering attack.

Find out how well aware of potential threats your staff are, and identify gaps in your processes which could allow attackers to breach your organisation via a social engineering attack.

Manual Not Automated

What will we find in a Social Engineering Penetration Test?

The outcome of a social engineering test is typically that our testers have gained unauthorised access to one or more of your systems or applications. You will receive a report detailing the actions we took, how we gained access and what weaknesses we exploited to do so.

Network Penetration Test Reporting
CREST Penetration Testing Logo

CREST Registered - CREST Certified

Are you CREST Certified?

OnSecurity is a CREST (Council of Registered Ethical Security Testers) approved vendor. This means that all our test methodologies, processes, policies and procedures have been externally vetted by CREST to ensure we are operating to the highest standards possible in the pentesting industry.

On top of this the majority of our testers are CREST certified, meaning they have been through a CREST assault course (or CREST-recognised equivalent) to ensure they have the requisite skills needed to find and exploit vulnerabilities in a safe and controlled manner.

This external validation means you can be confident your pentests are being carried out to the highest standard, by vetted and tested consultants, who use a best-in-class manual-first approach to testing.

Getting Started

Booking your Social Engineering Penetration Test

To book a social engineering test, you simply need to get in touch with our team. You can do this by calling us on +44 (0) 20 3289 6710 or email us on

Get A Quote
Question Speech Bubble


Our Services Area

Web Application Testing

Make sure hackers can’t steal data via your main web app, and protect your app users.

Read More

Mobile Application Testing

Android, iOS and cross platform we test them all.

Read More

Cloud Security Testing

Make sure your deployments are secure - including AWS, Azure and GCP.

Read More

External Infrastructure Testing

Test to see how your external IT perimeter would hold up against intruders.

Read More

Internal Infrastructure Testing

See what hackers can do once they are inside your network.

Read More

Phishing Simulation

32% of breaches involve phishing, test to make sure you’re not next.

Read More

Physical Penetration Testing

Office blocks, factories and power plants - if it has a door we can test it.

Read More

Social Engineering

Grabbing sensitive information over the phone or via email - you’ll be suprised what attackers can get

Read More

Need A Hand?

Get In Touch