6. SOCIAL ENGINEERING (SE) – SE testing is designed to assess employee securityawareness and response related to one or more SE attack vectors. SE attack vectors include email Phishing, fake websites, physical security breach, in-person interaction (impersonatingan employee, vendor, etc.), pretexting phone calls, and USB drops.

a. Email Phishing Campaigns – this exercise test employee awareness of suspicious emails, email content (attachments and links), and the likelihood of reporting these attempts internally. The exercise is typically limited to a subset of employees and is carefully coordinated with Company management, both in approach and design as well as execution and duration. Testing duration is typically 2-3 weeks with 1 week of design and preparation. Deliverables include an executive summary report detailing our approach, statistics related to number of emails successfully delivered and read by employees, details on which employees opened an attachment and/or clicked an embedded link.

b. Pretexting Phone Calls – testing that directly targets Company employees via phone calls as either a standalone attack or in conjunction with email phishing and/or physical breach attacks. The phone calls can add legitimacy to phishing emails or support physical breach attempts – similar to today’s real-world attacks. Testing includes impersonating internal employees, vendors, trusted contacts, or other agreed personas. Testing will be closely coordinated with Company management with regard to approach and timing.