Penetration Testing
Social Engineering Testing Services
Social engineering testing services measure how your people respond to the tactics attackers actually use: phishing emails, phone pretexts and, where agreed, on-site visits. Every campaign is ethical and agreed in advance, and as an ISO 27001-certified firm we handle campaign data securely and report by team, not by name.
Prefer to talk? Call +44 161 523 5276
- Phishing, vishing and physical pretexts
- Results by team, not by name
- Feeds straight into awareness training
Trusted by banks, payment providers and global brands
On this page
- Social engineering testing services: what's included
- What we assess
- Which social engineering attacks do you test?
- What does a social engineering assessment include?
- What does a social engineering test measure?
- What are the six principles of social engineering?
- How is a social engineering test carried out?
- Why choose Sovereign Secure for social engineering testing?
- Frequently asked questions
Overview
What is social engineering penetration testing?
The short answer
Social engineering testing is an authorised exercise that measures how your staff respond to the tricks attackers use on people: phishing emails, phone pretexts (vishing) and, where agreed, on-site visits. A social engineering test reports click, submission and reporting rates by team, not by name, and shows where awareness training should focus.
Technical controls only go so far when an attacker targets your people. Social engineering testing measures how staff respond to phishing, pretext phone calls and other manipulation, using agreed scenarios that mirror the tactics real attackers use.
We run phishing simulation campaigns across your organisation, and, where scoped, add voice (vishing) and physical pretext scenarios such as tailgating and visitor checks. The goal is not to catch people out but to give you honest data on where awareness is strong and where it needs support.
Social engineering is how many real intrusions start, so the results of social engineering pentesting are most useful alongside technical testing. A successful phish shows what an attacker could reach next, which an internal penetration test then measures. For an end-to-end exercise that combines both and tests your detection and response, see red team assessments. New to testing? Our guides to what penetration testing is and the types of penetration testing show where this test fits.
Results feed directly into staff training and support ISO 27001:2022 Annex A 6.3 (information security awareness, education and training). Cyber Essentials Plus tests technical controls rather than people, so phishing testing complements a CE+ audit rather than counting towards it.
What's included
Social engineering testing services: what's included
A social engineering engagement can combine phishing, voice and physical scenarios.
- 01
Email phishing campaigns
Realistic email campaigns tailored to your organisation, tracking who opens, clicks and submits credentials.
- 02
Spear-phishing scenarios
Targeted campaigns against specific roles or teams where a focused test is more revealing.
- 03
Voice pretext (vishing)
Controlled phone-based scenarios that test how staff respond to convincing pretexts, where in scope.
- 04
Physical pretext testing
On-site scenarios that test tailgating, visitor controls and physical access, where in scope. Our guide to physical penetration testing covers scope and authorisation.
- 05
Agreed, ethical scope
Scenarios, targets and boundaries agreed with you in advance, with clear rules of engagement.
- 06
Response measurement
Metrics on click, submission and reporting rates, so you can see how people responded.
- 07
Awareness recommendations
Practical guidance to strengthen training, process and technical controls.
What we test for
What we assess
We assess the human layer across the channels attackers actually use.
Email phishing
How staff respond to deceptive email designed to harvest credentials or trigger action.
- Credential-harvesting campaigns
- Malicious attachment and link lures
- Business email compromise scenarios
- Brand and supplier impersonation
- Click, submission and reporting rates
Targeted spear-phishing
Focused campaigns against high-value roles and teams.
- Executive and finance targeting
- Role-specific pretexts
- Lures based on OSINT research
- Payment and invoice fraud scenarios
- Response of privileged users
Voice pretext (vishing)
Phone-based scenarios that test verbal manipulation and verification.
- Help-desk and password reset pretexts
- Supplier and authority impersonation
- Information-disclosure attempts
- Bypass of caller verification
- Escalation and reporting behaviour
Physical pretext
On-site scenarios that test physical access controls and staff vigilance.
- Tailgating and visitor controls
- Reception and sign-in processes
- Unattended workstation checks
- Sensitive-area access attempts
- Response to unfamiliar visitors
Human-risk metrics
The measurements that turn an exercise into actionable insight.
- Susceptibility rates by team
- Reporting and escalation rates
- Time to report a suspicious message
- Repeat-clicker trends over campaigns
- Effectiveness of existing awareness training
Which social engineering attacks do you test?
We test the routes attackers use against people most often: by email, by phone and in person. Each scenario is agreed with you in writing before it runs, and the table shows what is simulated in each case.
| Attack type | What is simulated | Learn more |
|---|---|---|
| Phishing | Emails that lure staff into clicking a link, opening an attachment or entering credentials on a look-alike page | What is phishing? |
| Spear phishing | Targeted emails to named roles, such as finance staff or executive assistants, built from open-source research on your organisation | Spear phishing explained |
| Vishing | A vishing simulation: phone calls posing as IT support, a supplier or a senior colleague, testing caller verification and password reset processes | Vishing explained |
| Pretexting | A believable cover story, by phone or in person, used to ask for information, access or a change to supplier bank details | Pretexting and other techniques |
| Tailgating | Following staff through controlled doors or past reception, testing visitor and access controls on site | Physical penetration testing |
After a campaign, our guide on how to spot phishing emails gives staff a short list of warning signs to look for.
Our guide to phishing simulation examples walks through seven scenarios, from a parcel delivery text to an MFA reset call.
What does a social engineering assessment include?
A social engineering assessment includes agreed objectives and limits, scenarios built for your organisation, the campaign itself, measurement of how people responded, and a report that turns the results into actions. Nothing runs until the scope is signed off by someone with the authority to approve it.
| Stage | What it covers |
|---|---|
| Objectives and limits | Who is in scope, which channels (email, phone, on site), what is off limits and who is briefed as a trusted contact |
| Scenario design | Lures and pretexts built around your suppliers, systems and working patterns, informed by open-source research where agreed |
| Delivery | Emails sent or calls made over an agreed window, with tracking that records opens, clicks, submissions and reports |
| Measurement | Response rates by team and role, time to the first report, and how suspicious messages or calls were escalated |
| Reporting and debrief | Results by team rather than by name, examples of the lures used, and practical recommendations for training and controls |
What does a social engineering test measure?
A social engineering test measures behaviour, not knowledge. The report tracks a small set of metrics by team and by campaign, so you can see where awareness is strong, where it needs support and whether it improves over time.
| Metric | What it shows | How to read it |
|---|---|---|
| Click rate | The share of recipients who opened the link or attachment in a phishing email | A first measure of susceptibility; compare it between teams and between campaigns rather than against an outside figure |
| Credential submission rate | The share who entered a username and password, or other data, on the simulated page | Usually the most serious result, because credentials are what an attacker needs to log in |
| Report rate | The share who reported the email or call through the agreed route | The behaviour you want to grow; a rising report rate matters as much as a falling click rate |
| Time to first report | How long after the campaign started the first person reported it | How quickly your security team would hear about a real attack and could warn everyone else |
| Vishing disclosure rate | The share of calls in which staff gave out information or acted without verifying the caller | Whether caller verification and password reset checks work in practice |
Results are reported by team and role rather than by name. Our phishing simulation page explains how repeat campaigns track the same metrics over time.
What are the six principles of social engineering?
Most social engineering relies on six principles of persuasion described by the psychologist Robert Cialdini: authority, urgency or scarcity, liking, reciprocity, commitment and social proof. Attackers use them to rush people past the checks they would normally make, and a good test uses the same levers so you can see which ones work on your staff.
| Principle | How attackers use it | Example lure |
|---|---|---|
| Authority | Posing as a director, the IT team, a bank or a regulator so the request feels hard to refuse | An urgent email from the finance director asking for a payment to be released |
| Urgency or scarcity | Setting a deadline or a limited offer so there is no time to check | A password expiry warning that says the account locks in one hour |
| Liking | Being friendly, familiar or similar to the target to lower their guard | A caller who chats about a shared interest before asking for a quick favour |
| Reciprocity | Giving something first so the target feels they owe a favour back | A free voucher or useful tip followed by a request for information |
| Commitment | Getting a small yes first, then asking for more | A survey that starts with harmless questions and ends by asking for login details |
| Social proof | Suggesting that colleagues have already done what is asked | An email saying most of your team have already completed a security check |
How it works
How is a social engineering test carried out?
- 1
Scoping
We agree the objectives, channels, targets, scenarios and rules of engagement, and fix the price.
- 2
Preparation
We build the campaigns and pretexts, informed by light reconnaissance where agreed, and set up tracking.
- 3
Delivery
We run the campaigns over an agreed window, capturing how staff respond without disrupting the business.
- 4
Reporting
A report with response metrics, examples and clear recommendations for training and controls.
- 5
Debrief
A walkthrough with your team, and, where wanted, support for follow-up awareness activity.
- 6
Follow-up campaign
An optional repeat campaign to measure improvement after training.
Where a successful lure leads on to technical testing, the work follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for social engineering testing?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Campaigns designed to educate, not to embarrass, with results that drive better training.
- Multiple channels, from email through voice to physical pretext, scoped to your needs.
- Metrics you can track over time to show awareness improving.
- Findings that serve as ISO 27001 Annex A 6.3 awareness and training evidence.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Will this single out or embarrass individual staff?
No. The aim is to measure and improve organisational awareness, not to catch people out. We report trends and rates by team rather than punishing individuals, and we agree the tone and handling with you in advance.
What happens in a vishing simulation?
A tester phones agreed staff with a pretext, such as IT support resetting a password or a supplier changing bank details, and records whether they verify the caller, give out information or take the requested action. Calls follow an agreed script and limits, and results are reported by team. Our page on vishing explains how real attacks of this kind work.
Do you need to warn staff beforehand?
Usually not, since advance warning skews the results. A small number of trusted contacts are briefed so they can manage escalations, and we agree how to handle anyone who becomes distressed.
How often should we repeat social engineering testing?
Regularly rather than once, so you can see whether awareness improves. For phishing, at least twice a year is a sensible starting point; our phishing simulation service page covers campaign frequency and planning.
What do you need from us for a social engineering test?
Agreement on objectives, target groups and scenarios, a list of in-scope email addresses or roles, and technical arrangements such as allow-listing so simulated emails reach inboxes. We confirm the detail during scoping.
Does this include the awareness training itself?
The engagement focuses on testing and clear recommendations. We can support follow-up training and provide material to address the weaknesses found, so the results translate into behaviour change.
Does social engineering testing support compliance?
Yes. It provides evidence for ISO 27001:2022 Annex A 6.3 (information security awareness, education and training) and for the human risks in your risk assessment. Cyber Essentials covers technical controls only, so phishing testing complements it rather than counting towards it.
Is social engineering testing legal?
Yes, when the organisation authorises it in writing and the scope is agreed in advance. We define the targets, channels and limits before any campaign starts, avoid staff’s personal accounts and devices, and stop immediately if a scenario risks real harm or distress.
What are the most common types of social engineering?
Phishing is the most common: the UK government’s Cyber Security Breaches Survey has reported it as the most frequent type of attack businesses identify in each recent year. Others include spear phishing, business email compromise, vishing, smishing, pretexting, baiting and tailgating. Our guide to types of social engineering attacks explains each one and how to test your defences.
How is this different from a red team assessment?
Social engineering testing measures how people respond to phishing, calls and visits, and reports the rates. A red team assessment uses social engineering as one route among several, pursues a specific objective and tests whether your security team detects it.
How much does social engineering testing cost?
Cost depends on the channels (email, phone, on site), the number of people and sites, how tailored the scenarios are and whether you want repeat campaigns. Our penetration testing cost guide covers the drivers, and you can get a social engineering testing quote with a fixed price.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Red team assessmentsRed teaming services and red team assessments: objective-led adversary simulation across technical, human and physical routes, under written rules of engagement.
- Internal Penetration TestingInternal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote.
- Cyber Essentials PlusCyber Essentials Plus certification and audit from an IASME-licensed certification body. Remote or on-site CE+ testing, clear sample sizes and a fixed quote.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]