Test the decisions attackers try to manipulate.
Social engineering attacks target human judgement rather than software vulnerabilities. Seraph conducts controlled testing to help organisations understand how employees respond to manipulation, urgency, authority, trust and impersonation.
Manipulation can bypass strong technical controls.
An attacker who successfully exploits trust or urgency doesn't need to defeat a firewall or endpoint protection — they need one employee to make one decision in their favour.
Testing Can Include
Where agreed and within authorised scope:
- phishing
- email impersonation
- business email compromise scenarios
- credential-harvesting simulations
- telephone-based scenarios
- messaging/social-channel scenarios
- physical social engineering where explicitly scoped
- information disclosure testing
How an Engagement Works
- 01
Scope
Agree objectives, users, channels, exclusions and safety boundaries.
- 02
Scenario Design
Build scenarios relevant to the organisation.
- 03
Controlled Testing
Execute authorised scenarios within agreed conditions.
- 04
Evidence & Analysis
Record behavioural observations without unnecessary collection of sensitive information.
- 05
Recommendations
Identify behavioural and procedural controls requiring improvement.
Governance
All testing must be:
- explicitly authorised
- controlled
- ethically conducted
- limited to agreed scope
- designed to avoid operational harm
- aligned with organisational policies
- ChannelsEmail, telephone
- AudienceIT helpdesk
- AuthorisationSigned scope agreement
- StatusIn scoping
See where trust and urgency could be exploited.
Understand where manipulation of trust, authority or urgency could bypass otherwise strong technical controls.
Assess your social-engineering exposure.
Tell us about your organisation and current human risk programme. Our team will help scope the right next step.