PT/03 · Penetration testing
Would your team hand over the keys?
Realistic phishing, phone and text-message campaigns that show how your team and your processes respond, followed by training aimed at what actually worked.
01Overview
What we look at.
We build campaigns around what a real attacker could learn about your business. You approve every scenario in writing before anything is sent.
Results are reported in aggregate, so the outcome is better habits and stronger processes, not blame.
In scope
- Email phishing
- Phone calls to staff and your help desk
- Text messages
- Password reset and payment-change procedures
- How quickly suspicious messages get reported
02Why test
What you get out of it.
Practise for the real thing
Attackers target people because it works. A campaign shows how your team responds before a real attacker finds out.
Measure awareness
A clear baseline you can improve against, year over year.
Test the process, not just people
Some of the costliest gaps are procedures, like a payment change approved on a single phone call. We find those.
Train on what actually worked
Follow-up training built around your results, not a generic annual video.
Ground rules
- Passwords are never captured or stored
- Nothing harmful is ever sent
- Personal accounts, family and sensitive topics are off limits
- Remote only: email, phone and text
03Included
Every engagement includes.
See a sample reportA clear, written report
A summary for leadership, then each finding with evidence, a severity rating and a fix your team can act on.
Critical findings, same day
If we find something critical, we call you that day instead of waiting for the report.
Retest included
Once fixes are in, we retest at no extra cost and update the report with what's closed.
Attestation letter
A one-page summary of scope, dates and outcome for customers, auditors and insurers.
Readout call
We walk your team through the results and agree what to fix first.
Your data, handled carefully
Test evidence stays encrypted and is deleted after the retest unless you ask us to keep it.
04FAQ
Common questions.
How long does a campaign take?
Usually two to four weeks from planning to report, with activity spread out so it blends in with normal business.
What does a social engineering campaign cost?
Every test gets a fixed quote after a free scoping call, based on what's actually in scope. No hourly billing and no surprises on the invoice.
How often should we run one?
At least once a year, and after big changes such as a merger, a new email system or a wave of new hires. Short drills between campaigns keep the habit fresh.
Do you single people out?
No. Results are reported in aggregate. Individual results go only to the contact you name, and the goal is training, not discipline.
Do you do physical break-in testing?
No. Our campaigns are remote: email, phone and text message.
Should we warn staff first?
No. That defeats the point. Get HR on board, name a contact on your side, and we handle the rest.
Other testing
PT/01
Network & Microsoft 365 testing
What an attacker can reach from the internet, how far they could get once inside, and how well your accounts hold up.
PT/02
Web application testing
Your customer portals, web apps and integrations, tested by people trying to make them do what they shouldn't.
PT/04
AI system testing
The chatbots, copilots and AI assistants you've deployed, tested for what they could be talked into revealing or doing.
Next step
Scope your test.
You'll speak with the person who does the testing. We reply within one business day.