Social Engineering Penetration Testing Services

Phishing is by far the most common type of social engineering tool, and over 90% of all data breaches result from phishing. Approximately one in 99 emails contain a phishing attack, and these emails readily make their way to commercial and business users.

This social engineering technique sends emails that masquerade as emails from legitimate entities to acquire information such as login and credit card details. Phishing emails are often cloaked as emails from online banks, social media sites, IT firms and auction sites.

Phishing is one of the most expensive cyberattacks that costs an average of $4.65 million to remediate.
Vishing is the use of phone calls to achieve the same result as phishing, while smishing uses SMS/text messages.

This is a form of cyber social engineering very similar to phishing, except that the emails are targeted at specific individuals. Attackers research the receiver and know who this individual views as trusted email sources. They could even mimic the victim’s personal emails and trick them into clicking on malicious links or attachments.

This is a recently popularised form of cyber security social engineering that uses malware such as rogue anti-spyware, anti-malware, scanners or scareware to deceive users. The hackers use rogue security software to mislead users into believing they can help them remove malware at a fee.

Pretext social engineering attacks involve an attacker impersonating someone in a powerful position. They could pretend to be company managers, auditors, members of the IRS or police officers. Since scammers demand information under the pretext of authority, victims are more likely to provide it.

Baiting is a way of luring victims by offering them something or piquing their interest. An example is a free download using social media engineering or even a USB drive with a provocative label. Once you download the file or use the infected device, malware is installed on your computer, giving access to the hacker.

This is another one of the many methods of social engineering where a hacker pretends to be a member of IT support staff. They then call employees and claim they need to perform a system fix and need the employee to disable their antivirus software.

Hackers can also ask employees if they need technical assistance, and once an employee says they need help, they will be asked to provide personal user credentials. Employees who follow these instructions are likely to experience a malware attack.

This is a physical aspect of social engineering where intruders gain access to office buildings or business locations. An attacker can tailgate an authorised user by following them into the premises without their knowledge.

Piggybacking is very similar to tailgating, except the authorised entrant knowingly lets the intruder into the premises. They could hold the door open for someone with a heavy load or an employee who forgets their access cards.

This is the social engineering reconnaissance stage of social engineering pen testing. It requires our team to collect information about your organisation from public sources.

This step is performed before conducting social engineering testing. We consult with your IT team to establish the assessment requirements and the scope of the social engineering penetration test

At this stage, Mindfire's social engineering penetration testing team attempts to breach your systems or office premises and collect sensitive information. Testing could involve using phishing services to send random phishing emails to employees and monitoring their different actions. A social engineering company will also attempt to enter business offices and obtain company data.

Mindfire's social engineering pen testing team takes the reporting of test results as a crucial part of penetration testing. We prepare a full technical report for software engineers that sets out the goals of the test, the social engineering testing methodology and the vulnerabilities we identify. We also provide an executive report more appropriate for managerial teams and other employees that summarises our activities.

Because employees are the biggest deterrent from social engineering attacks, we recommend investing in regular social engineering training. Conduct workshops or awareness exercises to give employees the skills to identify and respond to cyber threats.