Social Engineering & Phishing Simulations
Test your human attack surface with realistic social engineering campaigns
What this engagement covers
The service
Social engineering is the most common initial access vector in real-world breaches. Our social engineering assessments simulate phishing emails, vishing calls, pretexting scenarios, and physical social engineering to measure how well your employees detect and respond to manipulation attempts.
What we test
We test your organization's resilience to phishing emails (credential harvesting, payload delivery, business email compromise), vishing (voice phishing calls), smishing (SMS-based attacks), pretexting (impersonation scenarios), and physical social engineering (badge cloning, tailgating, dumpster diving). We measure click rates, credential submission rates, and reporting rates.
Scoping & Assessment Depth
Black Box Assessment
Zero-KnowledgeSimulates an external adversary targeting Social Engineering & Phishing Simulations with no internal credentials, source code, or architecture documentation. Assesses perimeter exposure, unauthenticated attack paths, and edge resilience.
Gray Box Assessment (Recommended)
CredentialedSimulates an authenticated user, tenant, or insider threat within Social Engineering & Phishing Simulations. We evaluate role segregation, authorization boundaries, privilege escalation, and business logic flaws across user tiers.
White Box / Source-Assisted
Full-KnowledgeConducted with direct access to architecture schematics, configuration files, and API/code documentation. Eliminates blind spots and provides exhaustive coverage of security mechanisms governing Social Engineering & Phishing Simulations.
Attack Surface & Vulnerability Vectors
High Phishing Click Rates (>20%)
Rigorous testing and validation to uncover High Phishing Click Rates (>20%) across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Credential Submission Without Verification
Rigorous testing and validation to uncover Credential Submission Without Verification across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Low Security Incident Reporting Rates
Rigorous testing and validation to uncover Low Security Incident Reporting Rates across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Susceptibility to Authority-Based Pretexts
Rigorous testing and validation to uncover Susceptibility to Authority-Based Pretexts across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Weak Email Filtering and DMARC Configuration
Rigorous testing and validation to uncover Weak Email Filtering and DMARC Configuration across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Tailgating and Badge Cloning Vulnerabilities
Rigorous testing and validation to uncover Tailgating and Badge Cloning Vulnerabilities across your Social Engineering & Phishing Simulations environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
How we run it
We design custom campaigns that mimic the exact tactics threat actors use against your industry. Each campaign uses realistic pretexts, branded landing pages, and multi-stage attack chains. We track every interaction and provide detailed analytics on who clicked, who submitted credentials, who reported the attempt, and how long it took. Results feed directly into security awareness recommendations.
OSINT reconnaissance on target organization
Rigorous technical execution, boundary verification, and manual exploitation testing targeting osint reconnaissance on target organization across your social engineering & phishing simulations deployment.
Custom phishing pretext and payload development
Rigorous technical execution, boundary verification, and manual exploitation testing targeting custom phishing pretext and payload development across your social engineering & phishing simulations deployment.
Email campaign deployment with tracking
Rigorous technical execution, boundary verification, and manual exploitation testing targeting email campaign deployment with tracking across your social engineering & phishing simulations deployment.
Credential harvesting landing page setup
Rigorous technical execution, boundary verification, and manual exploitation testing targeting credential harvesting landing page setup across your social engineering & phishing simulations deployment.
Vishing and pretexting call campaigns
Rigorous technical execution, boundary verification, and manual exploitation testing targeting vishing and pretexting call campaigns across your social engineering & phishing simulations deployment.
Physical social engineering attempts
Rigorous technical execution, boundary verification, and manual exploitation testing targeting physical social engineering attempts across your social engineering & phishing simulations deployment.
Results analysis and metric generation
Rigorous technical execution, boundary verification, and manual exploitation testing targeting results analysis and metric generation across your social engineering & phishing simulations deployment.
Security awareness program recommendations
Rigorous technical execution, boundary verification, and manual exploitation testing targeting security awareness program recommendations across your social engineering & phishing simulations deployment.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Campaign design and pretext documentation
- Phishing simulation results with full analytics
- Click rate, credential submission, and reporting metrics
- Department and role-based breakdown analysis
- Vishing call recordings and results (if applicable)
- Security awareness gap analysis
- Targeted training recommendations by department
- Benchmark comparison against industry averages
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| SOC 2 Type II | CC4.1, CC7.1, CC7.2 | Technical testing evidence validating system boundaries, access restrictions, and vulnerability identification controls. |
| ISO/IEC 27001:2022 | Control A.8.8 & A.8.20 | Management of technical vulnerabilities and network security verification through independent technical assessments. |
| NIST SP 800-53 Rev 5 | CA-8, RA-5, SC-7 | Rigorous penetration testing and technical vulnerability assessment supporting federal compliance and continuous monitoring. |
| PCI DSS v4.0 | Requirement 11.4 & 11.4.3 | Adversary-driven external and internal penetration testing with application-layer validation and vulnerability remediation verification. |
| HIPAA Security Rule | 45 CFR § 164.308(a)(8) | Formal technical evaluation verifying the integrity of ePHI safeguards, network segmentation, and privileged access safeguards. |
| CMMC 2.0 Level 2 / 3 | CA.L2-3.12.1, SC.L2-3.13.1 | Technical validation of Controlled Unclassified Information (CUI) protection, perimeter defense, and enclave isolation. |
Findings are mapped to SOC 2, ISO 27001, NIST 800-53, PCI-DSS, HIPAA, CMMC, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
Our Social Engineering & Phishing Simulations service combines deep manual testing with automated verification. We cover: Campaign design and pretext documentation, Phishing simulation results with full analytics, Click rate, credential submission, and reporting metrics, Department and role-based breakdown analysis, Vishing call recordings and results (if applicable). Every engagement includes reproducible proof-of-concept exploits, developer-ready remediation guidance, and a free retest.
Yes. Findings are directly mapped to SOC 2, ISO 27001, NIST 800-53, PCI-DSS, HIPAA, CMMC control requirements. The resulting report is auditor-ready and formatted for immediate submission to SOC 2 CPAs, PCI QSAs, and enterprise vendor risk assessment teams.
Yes. Every Lorikeet Security engagement includes free retesting within 30 to 60 days to validate that your remediation patches successfully resolve the identified vulnerabilities before your final report is issued.
Typical active testing turnaround is 2-4 weeks, with critical findings reported immediately via your Talon portal so your engineering team can begin remediation without waiting for the final PDF.
Pricing starts from $5,000. We scope the engagement in one call based on your environment's surface area, user roles, and complexity, providing a transparent, fixed-price quote with no hidden change orders.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
