Field Notes / Offensive Security
Social engineering penetration testing: how to commission one, and what you should get back
A social engineering penetration test sends a real attacker’s email, phone call or visitor at your organisation, with your written permission, and proves which one gets in. Here is what gets tested, how the test is scoped and signed off, how the report names broken processes instead of staff, and how to tell a real provider from a click-rate dashboard.
01 What you walk away with
ost buyers who search for a social engineering test have already run phishing simulations. They have a click rate. What they lack is an answer to the question the board will ask after an incident: if someone rings our helpdesk pretending to be the finance director, what happens next? A social engineering penetration test answers that with evidence.
A good report gives you four things:
- The attack paths that worked. A narrated sequence: the pretext, the channel, who it reached by role, what it obtained, and what that access would have led to next.
- The control that failed at each step. The helpdesk script with no call-back, the reset flow that trusted a mobile number, the door that stays open for anyone carrying a box.
- The control that held. The colleague who reported the email within minutes. The receptionist who asked for a host. You need to know what to keep as much as what to fix.
- A ranked fix list. Ordered by what each route reaches, written for the person who owns the process.
The stakes are well documented. Social Engineering was the third most common breach pattern in Verizon’s 2026 dataset, at 16% of more than 22,000 confirmed breaches. Pretexting reached 6% of all breaches as an initial access vector, and phishing held at 16% Verizon DBIR 2026 .
02 Four ways in, four tests
“Social engineering” covers very different attacks. Scope each one as its own question.
| Channel | What the tester does | The question it answers |
|---|---|---|
| Phishing simulation | A believable email to a broad group, with a link, an attachment or a fake login page | How many people act on a generic lure, how many report it, and whether filtering or MFA stops the result |
| Spear-phishing | A researched email to a handful of roles: finance, executive assistants, IT admins | Whether a lure built from your own public information gets a high-value account |
| Vishing and helpdesk resets | Phone calls posing as staff, suppliers or IT, including requests to reset a password or enrol a new MFA device | Whether your verification process holds when the caller sounds right and is in a hurry |
| Physical and tailgating | Following staff through controlled doors, posing as a contractor or visitor, testing reception and badge controls | Whether someone with no badge reaches a desk, a meeting room or a network port |
| USB drops | Marked, harmless drives left in car parks or shared spaces that report back when opened | Whether found media gets plugged in, and whether endpoint controls block it |
Phishing simulation and spear-phishing get confused most often. A simulation measures the population. Spear-phishing measures your exposure to the attacker who reads your LinkedIn page first. The senior version, aimed at the chief executive or finance director, is a whaling attack, and it is the one worth paying a tester to research properly.
Phone tests deserve more weight than most buyers give them. Verizon found the median click rate in simulations over voice and text messaging is 40% higher than over email Verizon DBIR 2026 . The helpdesk is the sharpest edge. In May 2025, after attacks on UK retailers, the NCSC told organisations to “review helpdesk password reset processes, including how the helpdesk authenticates staff members”, especially for accounts with escalated privileges NCSC 2025 . Two months later the M&S chairman told MPs the attack on his company began with a “sophisticated impersonation” involving a third party. M&S put the cost at £300 million in operating profit Claims Journal 2025 . The technique behind those calls, a built-up story that makes a request feel routine, is pretexting, and Verizon notes it arrives “frequently by voice communications” Verizon DBIR 2026 .
USB drops sound dated until you see the numbers. Researchers left 297 drives on a university campus and estimated that 45% to 98% were picked up and connected, the first within six minutes Tischer et al. 2016 .
03 Scope, authorisation and who knows
A social engineering test touches real people, so the paperwork does more work here than in a technical test. Get it right and the test runs quietly. Get it wrong and a receptionist calls the police, or an employee raises a grievance.
Rules of engagement
The rules of engagement set the objective, the channels, the target group by role, the dates, and the lines the tester never crosses. Typical hard limits: no impersonation of police or emergency services, no pretexts built on bereavement, illness, pay cuts or redundancy, no contact with staff on personal phones or social accounts, and no real data taken out. Credentials captured during the test prove the point and are then destroyed.
Who knows
A small control group knows the plan: the sponsor, someone from HR, legal or the data protection lead, and one person in security operations who can tell a test from a real attack. Everyone else does not. The control group holds a stop word and a 24-hour number for the tester.
Legal and HR sign-off
Unauthorised access to computer material is an offence under section 1 of the Computer Misuse Act 1990 CMA 1990 , so a person with the authority to grant access signs before anything starts. Physical testers carry a signed authorisation letter naming the sites, the dates and who to call to confirm it. If your offices sit in a shared building, the landlord or facilities manager signs too. If the helpdesk is outsourced, check the contract allows a test of the provider’s staff.
Bring HR in early. The NCSC warns that punishing people for clicking on emails you sent “starts to resemble entrapment” and advises checking with HR before running simulations NCSC .
UK GDPR
A test that records who clicked, who entered a password and who held a door processes personal data about your staff. The ICO’s guidance on monitoring workers applies. It expects a data protection impact assessment before monitoring, clear information to workers about what monitoring happens and why, and it treats covert monitoring as justified only in exceptional cases ICO via Baker McKenzie . In practice: state in your security policy that the organisation runs unannounced testing, complete the DPIA, have the provider pseudonymise results, and agree a short retention period for raw data.
04 Reporting without naming staff
The fastest way to waste a social engineering test is to turn it into a list of names. The NCSC is blunt: “Users who fear reprisals will not report mistakes promptly, if at all” NCSC . A named list trains people to hide the next click, and the next click is the one a real attacker sends.
Ask for a report built like this:
- Results by team and role, never by name. Findings read “a finance team member approved the request”, with the evidence held by the control group only where an investigation needs it.
- Time to first report alongside click rate. The minutes between the first email landing and the first report to security tell you more about resilience than how many people clicked.
- What happened after the click. Did MFA stop the captured password? Did the mail filter pull the remaining copies? Did anyone in security act?
- A debrief for the people involved framed as “here is how the attack worked”, so the people who were caught leave knowing the pattern.
05 Training, pentest, social engineering test
Three products get sold under overlapping names. They answer different questions.
| Activity | What it answers | What it cannot tell you |
|---|---|---|
| Awareness training and click-rate simulations | Whether staff recognise a generic lure, and whether recognition improves over time | Whether a targeted attack succeeds, or what the attacker reaches after the click |
| Technical penetration test | Which weaknesses in your systems, networks and applications open a door | Whether your people hand over the access the attacker never needed to exploit |
| Social engineering penetration test | Which human and process routes get an attacker in, and how far each leads | Coverage of your technical estate, which a technical test provides |
The NCSC calls training “the layer that is often over-emphasised in phishing defences” and states that no training package, including simulations, “can teach users to spot every phishing attempt” NCSC . Its guidance sets four layers: make it hard for attackers to reach users, help users spot and report, protect the organisation from the phishing that gets through, and respond quickly. A social engineering test checks all four in one run. Training reaches only the second.
The test also completes a technical one. Our penetration testing services already cover physical entry and wireless alongside networks, applications and cloud. A social engineering test supplies the foothold a real intruder would arrive with: one working staff login, or one laptop on a desk. Run together, they show the full chain from a phone call to your customer data.
06 Where CREST and the NCSC fit
CREST has no standalone social engineering accreditation. Its accreditation disciplines are Penetration Testing, Vulnerability Assessment, Intelligence Led Penetration Testing (STAR), Threat Intelligence for Simulated Attack (STAR), Incident Response and Security Operations Centres CREST . STAR stands for Simulated Target Attack and Response, CREST’s framework for intelligence-led attack simulation, with a financial-sector variant, STAR-FS CREST .
For a buyer, that means two things. A social engineering test bought as part of a penetration test should come from a provider accredited for penetration testing, delivered by certified individuals. A test bought as part of an objective-led red team, where the brief is “reach the payments system by any route”, sits closer to the STAR disciplines. Providers that advertise “CREST-accredited social engineering” are describing one of these, so ask which.
The NCSC phishing guidance is the most useful document to put in front of your board. It sets the four layers above, warns against a blame culture, and points out that simulations “erode trust between employees and security” when run badly NCSC . A test designed against that guidance measures the layers and protects the trust.
07 How to choose a provider
Put these questions to every shortlisted provider. The answers separate a test from a click-rate dashboard.
- Who runs the calls and writes the pretexts? Ask for the operators by name and certification, and whether they are the same people who run your technical tests.
- Will the vishing include your helpdesk reset process, and MFA device enrolment as well as passwords?
- How do you research targets? Expect open-source research on your organisation and roles, with no contact on personal accounts.
- What happens after a click or a captured password? A real test follows the access to show what it reaches, within the agreed limits.
- Which pretexts are off-limits by default? A provider without a list has not thought about your staff.
- How are results reported? Insist on team and role, time to report, and process findings. Refuse a named list.
- How is staff data handled? Ask for pseudonymisation, a retention period and help with your DPIA.
- What does a physical tester carry, and who do they call if challenged?
Every organisation has a call its helpdesk should refuse and a door that opens for a confident stranger. You can find yours before an attacker does. Start with the free security audit: a short call, a first look at what your organisation exposes, and a clear view of which human routes are worth testing first. If you already know you need the full test, our CREST-certified penetration testing team scopes the social engineering work alongside your technical estate, so you see one attack path from the first call to the data it reaches.
Questions readers ask
What is a social engineering penetration test?
A social engineering penetration test is an authorised attempt to get into your organisation through its people and processes. A tester sends targeted emails, calls your helpdesk or staff, or tries to walk into your building, under written rules of engagement you sign first. You get back the attack paths that worked, the process or control that let each one through, and the fix for each. Results are reported by process and team, with no member of staff named.
What does a social engineering test include?
It depends on the scope you agree. The usual components are phishing simulation across a wide group of staff, targeted spear-phishing against a small number of roles, phone-based pretexting (vishing), including calls to the IT helpdesk asking for password or MFA resets, physical entry attempts such as tailgating through controlled doors, and USB drops. A good provider recommends the channels that match how you would actually be attacked, and leaves out the ones that only produce a number.
Is a social engineering penetration test legal in the UK?
Yes, when it is properly authorised. Accessing a computer system without authorisation is an offence under section 1 of the Computer Misuse Act 1990, so the organisation that owns the systems signs a written authorisation before testing starts. Physical testers carry a signed authorisation letter with a 24-hour contact. Because the test processes data about staff, run it past HR and your data protection lead, and follow the ICO’s guidance on monitoring workers, which expects a data protection impact assessment before monitoring.
Should staff be told about a social engineering test in advance?
Staff should know, through policy, that the organisation runs security testing, which is what the ICO’s guidance on transparency expects. They should not know the date, the channel or the pretext, or the test measures nothing. A small control group, usually the sponsor, HR, legal and one person in security operations, knows the details and can stop the test at any point.
How is a social engineering test different from security awareness training?
Awareness training teaches people what an attack looks like. A social engineering test measures whether your processes and controls stop an attack when someone does not spot it. The NCSC calls training the layer that is often over-emphasised in phishing defences. A test tells you what happens after the click: whether the helpdesk verified the caller, whether the second factor held, whether anyone reported it and how fast security responded.
Does CREST accredit social engineering testing?
CREST has no standalone social engineering accreditation. Its accreditation disciplines are Penetration Testing, Vulnerability Assessment, two STAR disciplines for intelligence-led testing, Incident Response and Security Operations Centres. Social engineering is usually delivered within a CREST-accredited penetration test or within intelligence-led red teaming. Ask a provider which discipline covers the work, and which certified individuals will run it.
References
Sources
- Verizon. “2026 Data Breach Investigations Report: Executive Summary.” Published 19 May 2026. verizon.com
- NCSC. “Phishing attacks: defending your organisation.” Guidance. ncsc.gov.uk
- NCSC (Jonathon Ellison and Ollie Whitehouse). “Incidents impacting retailers: recommendations from the NCSC.” Blog post, 4 May 2025. ncsc.gov.uk
- Claims Journal / Bloomberg. “M&S Says April Cyberattack Caused by Third-Party Impersonation.” 8 July 2025. claimsjournal.com
- Tischer, M. et al. “Users Really Do Plug in USB Drives They Find.” IEEE Symposium on Security and Privacy, 2016. research.google
- CREST. Accreditation disciplines. crest-approved.org
- CREST. “Red Teaming”: STAR and STAR-FS intelligence-led penetration testing. crest-approved.org
- Baker McKenzie. “ICO guidance on monitoring of workers: key takeaways for employers.” 26 October 2023 (summary of ICO, Employment practices and data protection: monitoring workers). connectontech.bakermckenzie.com
- Computer Misuse Act 1990, section 1: unauthorised access to computer material. legislation.gov.uk. legislation.gov.uk
Close the gap this note describes
- Penetration testing You see the way in an attacker would use today, how far it reaches and what to close first.
- Free audit We map what you expose to the internet and send back the routes in, ranked by what each one reaches.
- Dark web check for partners For IT providers: name one client and we sweep breach dumps and forums for their leaked credentials.
