Social Engineering Testing

Rather than defeating technical controls, attackers often try to persuade an employee to share a password, open an attachment or hold a door. However strong technical controls are, the security picture is incomplete until processes and awareness are measured against these scenarios.

• Phishing: Tailored emails measure link clicks, credential submission and attachment opening.
• Vishing (voice phishing): Calls posing as the help desk or a supplier request information or access.
• Physical entry: Badge access, visitor registration and tailgating controls are tested and access to restricted areas is attempted.
• Removable media: Employee reactions to objects such as USB drives left in the office are measured.

Social engineering tests are performed only with written approval from an authorized executive and within pre-agreed rules.

• Targets, scenarios and prohibited methods are clearly defined in the contract.
• During physical tests the team carries an authorization letter and an emergency contact number.
• Personal data is processed in line with Turkey's Personal Data Protection Law (KVKK, Law No. 6698); employees' private lives are never used in scenarios.
• Captured credentials are not retained and appear masked in the report.
• The report highlights process and control gaps, not individuals.

• Success rates and timeline for each scenario.
• Reporting behavior: the share of employees who reported the attempt to security.
• Gaps in processes and physical controls.
• Recommendations for awareness training and technical measures.

Organizations that want to measure the impact of awareness training, handle many requests through a call center or help desk, rely on critical physical access controls, or are preparing for a red team engagement.