Adversary simulationSocial engineering testing
Social Engineering Penetration Testing Services
Social engineering penetration testing is an authorized simulation of phishing, vishing and pretexting that shows how your people and controls handle deception.
Key facts
- Price
- Quoted individually
- Formats
- Phishing and vishing, agreed per project
- Testers
- OSCP, OSCE, CISSP certified
- Contract
- NDA on request · professional indemnity insurance
Priced in tester-days NDA on request Retest available after fixes How the test works See a sample report
Pentestica runs it for companies that need proof their awareness training and verification steps work, under written rules of engagement that also set how results are reported.
What a social engineering test covers
- Email phishing and spear phishing
- Vishing against service desk and finance
- Pretexting built around your processes
- Results by scenario, team or role
Channels, targets and limits agreed in writing before any contact. Scoped and quoted per engagement. Priced in tester-days, no hidden fees.
Social engineering penetration testing is an authorized simulation of phishing, vishing and pretexting attacks that shows how your people, processes and technical controls respond when someone tries to deceive them. A campaign tests three things at once: whether messages and calls get past your technical controls, whether people follow verification procedures, and whether anyone reports the attempt. Targets, scenarios and limits are agreed in writing before the first email is sent.
Campaigns are designed and run by our penetration testing team: 25 certified senior pentesters (OSCP, OSCE, CISSP) with 500+ penetration tests behind them. We sign an NDA before testing and carry professional indemnity insurance. Social engineering testing is quoted individually, in tester-days after a scoping call.
Last updated: October 28, 2026
Key takeaways
- Scope: email phishing, spear phishing, vishing (phone) and pretexting, agreed per project.
- Every campaign runs under written rules of engagement signed by someone who can authorize it.
- Results can be reported by scenario, department or role instead of by name; you decide this in the rules of engagement.
- Captured credentials or a successful phone pretext are reported to your contact during the campaign.
- Price: quoted individually after a scoping call; a follow-up campaign is available after fixes.
Quoted individually
Scoped per project and priced in tester-days after a scoping call, with no hidden fees.
Written rules of engagement
Targets, exclusions, pretexts and stop rules are signed off before the first email.
NDA and insurance
We sign an NDA before testing and carry professional indemnity insurance.
Two-part report
Executive summary and technical report, with a retest available after fixes.
What is social engineering penetration testing?
Social engineering testing measures whether an attacker could get credentials, access or sensitive information by manipulating people instead of breaking software. A tester sends realistic messages or makes calls and traces which controls stopped the attempt.
It’s a recognized assessment technique. NIST SP 800-115 lists social engineering among the target vulnerability validation techniques, next to password cracking and penetration testing. MITRE ATT&CK describes the attacker side in detail: Phishing (T1566) to gain access, Phishing for Information (T1598) to collect credentials, and Spearphishing Voice (T1566.004) for phone-based attacks.
Know which teams and channels to test?
Send us the channels, the groups in scope and your deadline, and get a written scope, tester-days and a fixed price for that scope. Prefer to compare first? See our prices.
Which social engineering attacks do we simulate?
We simulate the channels you choose during scoping, with scenarios built around the services, suppliers and processes an attacker would actually imitate.
Email Phishing
A campaign to a defined group of employees that tests whether messages get past email filtering, whether people open links or enter credentials, and whether anyone reports the message.
Spear Phishing
Fewer, more targeted messages to roles an attacker would pick on purpose, such as finance, HR, IT administrators or assistants with access to executive mailboxes.
Vishing (Voice Phishing)
Phone calls that test verification steps, for example whether a service desk resets a password or MFA method for a caller who only sounds like an employee.
Pretexting
A believable story, such as a supplier changing bank details or a colleague who needs a file urgently, used across email and phone to test approval and callback procedures.
Physical Testing
On-site attempts to get into a building are a separate engagement, physical penetration testing, scoped and authorized on their own. Tell us if you’d like both in one project.
When does a social engineering test make sense?
It makes sense when you need proof of how people and procedures behave under a realistic attempt.
After Awareness Training
You’ve rolled out training and want an independent check of whether it changed behavior, including how many people report a suspicious message.
Before a Customer or Audit Review
An enterprise customer’s security questionnaire or your auditor asks how you test resistance to phishing, and you need a report rather than a statement.
After a Phishing Incident
Someone already fell for a real attack. A controlled test shows whether the fixes you made since then close the same route.
When a Process Changes
A new service desk, password reset flow or payment approval step is the right moment to test whether verification works as designed.
Social engineering testing vs phishing simulation, awareness training and red teaming
A social engineering test measures and explains, a phishing simulation platform repeats, awareness training teaches, and red teaming tests the whole defense. They answer different questions.
| Aspect | Social engineering test | Phishing simulation platform | Security awareness training | Red teaming |
|---|---|---|---|---|
| Main question | How far would a realistic attempt get, and which control failed? | How do click and report rates change over time? | Do employees know what to look for? | Can an attacker reach a defined objective, and does the team detect it? |
| Who runs it | Pentesters with a written scope | Your team, using a software product | Trainers or e-learning | A red team, across several attack vectors |
| Channels | Email, phone and pretexts chosen during scoping | Mostly email templates | No live attack | Any agreed vector, social engineering included if in scope |
| Output | Report with evidence, root causes and fixes | Dashboard metrics | Completion records | Attack path and detection findings |
If a campaign captures working credentials, the next question is what those credentials open. That’s what an internal penetration test answers, and for financial entities required by their supervisor to run TLPT under DORA, a threat-led penetration test covers the full attack chain.
How a social engineering engagement runs
1. Scoping and Rules of Engagement
We agree on channels, target groups, exclusions, timing, trusted contacts and how critical findings are reported. See how to define a penetration test scope.
2. Reconnaissance and Scenario Design
We review what an outsider can learn about your organization and draft pretexts, which are agreed with your trusted contact before launch.
3. Campaign Execution
Emails go out and calls are made in the agreed window. We track link clicks, credential submissions, call outcomes and reports to your security team.
4. Critical Findings During the Campaign
If a test captures credentials or a caller gets a password or MFA reset, we tell your named contact during the campaign, without waiting for the final report, so the account can be secured. Whether we may check that captured credentials work, and how far, is set in the rules of engagement.
5. Report and Debrief
You get an executive summary and a technical report, then a walkthrough you can turn into targeted training and control changes.
6. Follow-Up Campaign
A retest is available after fixes. We rerun the original scenario and similar ones, then mark each finding as fixed, partially fixed or still present.
What do we agree in the rules of engagement?
Social engineering testing is an authorized exercise: the organization approves it in writing, the test stays inside agreed limits, and local employment and privacy rules still apply. Before launch, we put the following on paper with you.
Who Authorizes the Test
A person with authority over the people and systems in scope signs off.
Who Knows in Advance
A small group of trusted contacts, so a real incident can be told apart from the test and the campaign can be paused if needed.
Targets and Exclusions
Which teams, roles and phone lines are in scope, and who is out, for example people on leave or roles you don’t want contacted.
Off-Limits Pretexts
Topics we won’t use, agreed with you in writing, so the test stays realistic without causing distress or damaging trust.
Data Handling
How any captured data, such as submitted credentials, is handled, who can see it and when it’s deleted.
Escalation and Stop Rules
Who we call if something unexpected happens and when the campaign stops.
What does the report show?
The report shows what happened, why it worked and what to change, with the focus on processes and controls rather than on individual employees. The technical part lists each finding with evidence, the control that should have stopped it and step-by-step remediation, such as MFA reset verification or a callback rule for payment changes.
Results can be grouped by scenario, department or role, as agreed in the rules of engagement. That gives your awareness program a starting point and keeps the focus on processes, not on the person who clicked. Report rates count as much as click rates. You can see the structure in our sample penetration test report.
How much do social engineering testing services cost?
Social engineering testing is quoted individually, in tester-days after a scoping call, with no hidden fees. Four things set the effort.
- Channels: email only, phone only, or both.
- Number of people and groups: a broad campaign or a few targeted roles.
- Depth of the pretexts: generic lures take less preparation than scenarios built around your real suppliers and processes.
- Follow-up: whether a retest campaign is part of the quote depends on the engagement.
Once the scope is agreed, the quote is a fixed price for that scope.
Prices for our other tests are on the penetration testing pricing page. To get a written scope and price, request a quote.
Do regulations require social engineering testing?
NIS2, GDPR, SOC 2 and ISO 27001 don’t name social engineering testing as a mandatory test, but they expect you to train staff and check that your measures work. A campaign report supports the second part: it shows whether those measures hold up.
- NIS2 (essential and important entities): Article 21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the risk-management measures, and Article 21(2)(f) calls for policies and procedures to assess the effectiveness of those measures.
- GDPR: Article 32(1)(d) lists, as appropriate, a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures.
- SOC 2 and ISO 27001: neither names social engineering testing as a required test. If your auditor asks how you check security awareness, our report can serve as evidence; your auditor decides what’s sufficient.
We don’t certify compliance: we provide the test and the report, and the assessment stays with your auditor or supervisor. Among our other penetration testing services, an external penetration test pairs well with a phishing campaign, because it shows what an attacker reaches without anyone clicking.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the campaign report look like?
Every campaign report opens with an executive summary of the scenarios and what they mean for the business. The technical part covers each finding: what happened, why it worked, the control or procedure that should have stopped it and what to change. A retest is available after fixes. See a sample penetration test report for the report format.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Our case studies
How we tested a FinTech API, a medical SaaS platform and a retail web store: scope, findings, fixes and the retest.
Frequently asked questions
Is social engineering testing legal?
Generally yes, when the organization that owns the systems and employs the people in scope authorizes it in writing, the test stays within agreed limits and it respects local employment and privacy rules. We sign an NDA before testing and run every campaign under written rules of engagement. Rules differ by country, so involve your legal or HR team when you set the scope.
What is the difference between phishing and social engineering?
Phishing is one type of social engineering: it uses email or messages to get someone to click, open a file or enter credentials. Social engineering is the wider category and also covers phone calls (vishing), invented stories (pretexting) and attempts to get into a building in person.
Will employees who click be named or disciplined?
Results can be reported by scenario, group or role, so the findings feed into awareness training and process fixes. Whether any individual data is shared, and with whom, is agreed in the rules of engagement before the campaign starts.
Do employees know about the test in advance?
Usually only a few trusted contacts know, because an announced test measures preparation rather than everyday behavior. Some organizations tell staff that testing will happen without giving dates.
What happens if someone enters their password?
The submission is logged as evidence and handled as agreed in the rules of engagement. If credentials are captured, your named contact hears about it during the campaign so the account can be secured. Whether we use captured access to go further is set in the rules of engagement.
Do you offer physical social engineering?
Yes, as a separate physical penetration testing engagement with its own authorization and scope. It can be combined with phishing and vishing in one project.
How often should we run a social engineering test?
One practical rhythm is to align tests with your awareness training cycle and run a follow-up campaign after fixes. New processes or a real incident are good reasons to test sooner.
Is a retest available?
Yes. A retest is available after fixes: we rerun the original scenario to confirm whether the gap is closed. Whether it’s included in the price depends on the engagement and is agreed in the quote.
Fixed-price quote
Request a social engineering test
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
Social engineering testing is quoted individually, in tester-days after a scoping call. All prices
What happens after you send it
- Tell us what to test Send the channels you want tested (email, phone or both), roughly how many people are in scope, any teams to target or exclude, and your deadline.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Campaign, report, follow-up Critical findings, such as captured credentials, are reported during the campaign. Retesting after fixes is available.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Written rules of engagement before any contact
- Executive summary and technical report