Can't find what you need?

Social Engineering Testing

Real Attacks Simulation, Remediation Advice and Practical Aid

With 19 years in cybersecurity and Certified Ethical Hackers on board, ScienceSoft helps companies evaluate and increase their employees’ resilience to social engineering attacks.

Social Engineering Testing Services - ScienceSoft
Social Engineering Testing Services - ScienceSoft

Social engineering penetration testing imitates the approach and techniques intruders use to trick employees into divulging sensitive information or enabling security system breaches. It helps evaluate your employees’ security awareness and adherence to security practices, including under the pressure of intimidation or urgency. Social engineering testing can come as a part of comprehensive penetration testing or as a separate service.

Phishing

Malicious emails sent to multiple employees.

Spear phishing

Emails sent to a specific employee(s) responsible for high-level decisions.

Whaling

Email attacks targeting the C-suite.

Vishing

Manipulative phone calls.

Smishing

Manipulative mobile text messages.

ScienceSoft’s Penetration Testing Consultant, CEH Uladzislau Murashka shares his experience:

"To test user behavior in case of phishing attacks (the most frequent type), we use:

  • Emails with malicious URLs, to check if the user clicked them.
  • Emails with fake invitations and forms, including login forms, to check if the user filled them.
  • Emails with executable files, to check if the user downloaded and/or installed them."

Social Engineering Tactics We Apply

Imitating cybercriminals, ScienceSoft uses persuasion techniques to make social engineering engagements plausible.

Authority

Posing as an authoritative person (e.g., a police official or the company's CEO) to pressure your employees into fulfilling the required action.

Intimidation

Threatening with severe consequences if certain actions are not performed.

Social proof

Implying that a required action is what many people do.

Scarcity

Making a time- or quantity-limited offer to cause subconscious desire to accept it.

Urgency

Calling to immediate action to make your employees act without thinking.

Familiarity

Impersonating people your employees like or have met before.

How We Test

Below we describe typical steps ScienceSoft takes during social engineering testing projects:

1

Planning

2

Reconnaissance

3

Attack preparation

4

Attack simulation

5

Reporting

+

Our Customers Say

  • 19 years in cybersecurity.
  • 200+ IT security assessment and consulting projects for healthcare, finance, manufacturing, telecom and other industries.
  • Certified Ethical Hackers on board.
  • Recognized as Top Penetration Testing Company by Clutch.
  • Efficient quality management and customers’ data security confirmed by ISO 9001 and ISO 27001 certificates.
  • ScienceSoft USA Corporation is listed among The Americas’ Fastest-Growing Companies 2022 by Financial Time.

Challenge #1

It is difficult to create lifelike test conditions to see how employees would respond to malicious psychological manipulation.

Solution

Solution

We ensure that employees are unaware of testing and can follow all the steps of real-world attackers:

  • Gathering information about the company and target employees from open sources.
  • Creating a story for the attack, which is easy to buy into.
  • Sending real emails and SMS, making real phone calls.

Hide

Challenge #2

It is difficult to build strong email security to recognize and resist phishing emails.

Solution

Solution

ScienceSoft helps reinforce email security by implementing and configuring:

  • SPF (Sender Policy Framework) to specify the servers and domains authorized to send emails on behalf of the company.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance) to protect the domain from being used in business email compromise attacks.
  • DLP (Data Loss Prevention) tools to block the transmission of sensitive data.
  • Email server anti-malware protection, such as attachment scanning and/or sandboxing.

Hide

Social Engineering Testing: Success Stories by ScienceSoft

Pentesting and Social Engineering Testing for Reconice to Improve ePHI Security

Pentesting and Social Engineering Testing for Reconice to Improve ePHI Security

As part of IT infrastructure pentesting for a speech recognition software provider, ScienceSoft imitated a phishing attack against the Customer’s staff to check their ability to recognize and withstand social engineering techniques.

Vulnerability Assessment, Pentesting, and Social Engineering Testing for a Retail Bank

Vulnerability Assessment, Pentesting, and Social Engineering Testing for a Retail Bank

As a result of mock phishing attacks, ScienceSoft’s ethical hackers convinced 65% of targeted employees to send personal data via email. ScienceSoft recommended that the Customer hold security training sessions for employees.

Code Review, Pentesting and Social Engineering Testing for an Award-Winning IT Company

Code Review, Pentesting and Social Engineering Testing for an Award-Winning IT Company

To find maximum security gaps endangering the Customer's cloud application, ScienceSoft combined source code review and penetration testing with social engineering testing.

Network Pentesting and Social Engineering Testing for a Mobile Operator

Network Pentesting and Social Engineering Testing for a Mobile Operator

During a pentesting project, ScienceSoft simulated phishing attacks to check if potential intruders can use social engineering to break into the Customer's network.

Social engineering testing

We plan, prepare and stage social engineering attacks in 3 days, as well as advise on raising employees' security awareness.

GO FOR TESTING

Social engineering testing and remediation

We help remediate social engineering risks identified as a result of mock social engineering attacks.

GO FOR TESTING AND REMEDIATION

Why Social Engineering Is a Cybersecurity Concern Number One

Social engineering has proven to be the most efficient way to get around a company’s cyberdefense:

82% of security breaches involve the human element.

Verizon Data Breach Report 2021

$4.65 million is the average cost of a breach caused due to phishing.

IBM Cost of a Data Breach Report 2021

14 is the average amount of malicious emails an employee receives per year.

2021 Tessian research

In 86% of organizations, at least one person clicked a phishing link.

CISCO 2021 Cybersecurity Threat Trends Report

Ensure Your Company Against Social Engineering Attacks

ScienceSoft’s ethical hackers create a real-world experience of human-based cyber attacks to help you evaluate and minimize social engineering risks.

All about Cybersecurity