Social Engineering Assessments

Social engineering assessments are authorized tests of whether people and business processes resist deceptive requests. They measure reporting, verification, escalation, and control behavior without collecting real credentials or singling out individuals.

itOffensive security and application security

Social Engineering Assessments

A social engineering assessment is an authorized security test of how people, procedures, and supporting controls respond to a deceptive request. It tests the human element alongside technical controls. The target is an organizational behavior or control, not an employee's character or job performance.

NIST describes social engineering as an attempt to trick someone into revealing information that could be used to attack systems or networks. The assessment use of that technique is narrower and governed by written permission. It asks a defined question, such as whether a recipient reports a suspicious message, verifies an unusual payment request through an independent channel, or follows a help-desk identity-check procedure.

Assessment boundary

Authorization is part of the assessment design. A signed rules of engagement defines the sponsor, assessment purpose, targets and exclusions, approved channels, time window, allowed data, emergency contacts, stop conditions, and evidence handling. It also names who can pause or stop the work. A platform feature or a realistic scenario never expands that boundary.

For a phishing assessment, the boundary should state whether messages are sent only to managed mailboxes, whether simulated landing pages record only an event, and whether credentials, personal data, attachments, or external recipients are forbidden. A safe design records the minimum event needed to answer the question. It does not retain a submitted password, collect production authentication tokens, impersonate emergency services, or create a real business obligation.

Social Engineering Assessments

Assessment boundary

Relevant careers