Social Engineering
Phishing, vishing, and physical pretexting engagements that measure how the organization actually performs when targeted, with adversary tradecraft and per-recipient verdict attribution.
Social engineering is the attack class that bypasses every dollar spent on tooling, because it targets the human layer. A social engineering engagement from Aegis & Spear produces a measured, defensible read on how the organization actually performs when adversary tradecraft is run against it. Not what the awareness vendor reports. Not what the email gateway’s “Threats Blocked” counter implies. What the actual recipients do when a credible pretext reaches them, with the gateway behavior characterized as part of the engagement rather than assumed away. The deliverable is something the executive team can actually use.
What’s in scope
Three engagement types fall under social engineering, and the right scope depends on what the organization needs to learn.
Phishing. Single-campaign or multi-campaign email assessments against a defined recipient population. Pretext-class variation is the analytical lever: the engagement runs two or more pretexts against comparable recipient groups so the comparison produces actionable findings, not just an aggregate click-through number. Infrastructure is provisioned end-to-end (aged sending domains, properly authenticated SPF, DKIM, and DMARC, content-layer plausibility) so the assessment characterizes the recipient response rather than the gateway’s reaction to commodity simulator traffic.
Vishing. Voice-based pretexting against named recipients with defined dial limits per recipient. Pretext design anchored to plausible internal or vendor scenarios that real adversaries use, not generic IT-help-desk scripts. Per-call outcome classification (information disclosed, credentials volunteered, action taken at the caller’s direction, hung up, escalated to security) so the deliverable distinguishes degrees of exposure.
Physical pretexting. In-person social engineering against facility access controls. Often paired with a physical penetration test scope when facility access is part of the broader assessment. Pretext design appropriate to the facility (vendor, contractor, delivery, regulator, candidate); rules of engagement explicit; safe-haven coordination with a designated client point of contact active throughout.
Explicitly out of scope: deepfake or synthetic-media pretexting, targeting of individuals outside the agreed scope, anything that bypasses the rules of engagement, and any pretext that exposes the recipient to non-cyber harm (medical emergencies, family safety claims, threats of any kind).
How engagements actually run
Engagements run against the Penetration Testing Execution Standard. Pre-engagement covers scope definition, recipient population selection, pretext class agreement, rules of engagement, escalation contacts, and an explicit timeline.
Intelligence gathering produces the pretext material: organizational structure, internal nomenclature, vendor relationships, communications patterns that an external adversary would observe in public. This phase is constrained to public sources and any client-provided artifacts; it does not include access to the recipient population’s mailboxes or internal systems.
Execution dispatches the pretexts against the agreed recipient population. Phishing campaigns are time-staggered so per-pretext behavior can be compared without confounding effects. Vishing dials are time-boxed and per-recipient capped. Physical pretexting runs against the agreed window with safe-haven coordination active throughout.
Capture and analysis is the work that distinguishes a useful engagement from a metric. Per-recipient verdict attribution separates scanner traffic from dispositive human engagement, distinguishes inspection-only behavior from credential capture, and characterizes the email gateway’s actual processing of each campaign. Aggregate numbers without per-recipient verdicts are misleading; the engagement does not produce them.
Reporting delivers an executive summary readable by a non-technical board member, a technical findings section with specific observations and remediation guidance, a pretext-class effectiveness comparison, and a consolidated finding with severity calibration. Letter of attestation is available at engagement close on client request.
The engagement runs against a fixed scope, fixed fee, and defined timeline. The firm’s approach covers engagement mechanics in more depth across all service lines.
What makes this engagement different
The work uses adversary tradecraft from someone who has built and run defensive cyber capability at scale, not rehearsed templates from a simulation platform. That distinction shows up in pretext design, infrastructure quality, and the analytical depth of the deliverable.
Pretexts are written to be credible against the specific recipient population, not against a generic professional services audience. The pretext-class comparison is structured so the findings drive program decisions: which kinds of pretext actually move the recipient population, and what that says about where awareness program attention pays back. Infrastructure is provisioned to look operationally indistinguishable from a real adversary’s send chain, so what the engagement measures is the recipient’s response, not the simulator’s signature.
The operator brings two decades of building defensive and offensive cyber capability at scale, including standing up the first Defensive Cyber Operations unit in the Marine Corps Reserve. More on the operator. The relevant point: this is a tester who has spent two decades observing real adversary tradecraft from the defensive side of operations, which produces sharper pretexts, more honest gateway characterization, and recommendations that account for what controls actually do.
The engagement does not use rehearsed pretext templates that a security awareness vendor would also use. The recipient population has likely seen those already; running them again teaches the population nothing it doesn’t already know.
What good outcomes look like
At engagement close, the executive team has a defensible read on how the human layer of the organization actually performs against adversary tradecraft. Specific recommendations tie to specific observed behavior, not to a generic “do more training” prescription. The pretext-class comparison identifies where awareness program attention pays back and where it doesn’t. The email gateway behavior is characterized rather than assumed, so the conversation about email security is grounded in what the gateway actually did during the assessment.
The deliverable includes a written report (executive summary, technical findings, pretext-class effectiveness comparison, consolidated finding with severity calibration, MITRE ATT&CK references where engagement-relevant), the underlying capture data the findings are drawn from, and a debrief call with the client team to walk findings and remediation. Letter of attestation is available on request.
The engagement does not make the organization secure against social engineering. No engagement does. What it produces is the kind of read on the human layer’s actual performance that lets security and IT leadership make program decisions on evidence instead of impression, and that lets the executive team have a board-level conversation about cyber risk grounded in what the organization can demonstrate, not what it hopes is true.
Findings frequently surface specific needs that justify follow-on engagement: penetration testing where credential exposure observed in the engagement needs validation against the technical attack surface, compliance audit work where the human-layer findings touch on regulatory training or notification obligations, or strategic advisory work where the executive response to a coordinated phishing campaign is the larger question.
Who this fits, and who it doesn’t
This engagement fits organizations with an existing security awareness program that want to know whether it is actually working, organizations with high human-attack-surface exposure (professional services firms, healthcare with patient-facing administrative staff, financial services), and organizations preparing for a board-level conversation about cyber risk where the human layer needs to be characterized with evidence.
This engagement does not fit organizations with no awareness program at all (the program needs to exist before measuring it), organizations under twenty-five employees (the recipient population is too small to produce statistically defensible findings), or organizations seeking a deliverable to punish employees with. Aegis & Spear does not run engagements whose purpose is to embarrass the workforce. Engagements are scoped to inform program decisions, not to score points against specific people.
Talk to us
If you are considering a social engineering engagement, reach out at contact@aegisandspear.com. Useful context in a first message: the recipient population size, the regulatory environment, whether an awareness program currently exists, and what the organization most wants to learn from the engagement. Response within two business days. The contact page covers what to include in initial outreach in more depth.