Social engineering, realistically tested

That depends on the individual case and needs a legal assessment. In practice it involves a mandate from management, a clear purpose and an evaluation that complies with data protection law. We plan this framework with you before the first scenario starts, including whether your data protection officer and, where one exists, the works council need to be involved. The legal assessment lies with you or your legal advisers; we do not provide legal advice, but we supply the information on scenario, procedure and evaluation that you need for this decision.

No. The aim is not to single anyone out but to improve processes and safeguards. Anyone who falls for a well-made simulation mainly shows where processes and awareness need sharpening. We therefore recommend evaluating by department or site rather than by person. How detailed the evaluation is and who sees which results is agreed with you before the start.

It depends on your goal: a single campaign shows the current state, repeated campaigns show whether your awareness measures work. A new test makes most sense after training and after major changes such as new processes, sites or tools. For comparable results, scenarios should be similar in difficulty but vary in content, so that employees are not simply recognising a familiar pattern.

Awareness training builds knowledge; a social engineering assessment measures how your organisation responds to real deception attempts. The assessment does not replace training, it shows where training should start and whether it works. Optionally we feed the results into your security awareness campaigns and give recommendations for strengthening awareness, focused on the departments and scenarios where the simulation succeeded most often.

For spear phishing we measure opens, clicks and data entered; for media drop tests we measure whether the medium is plugged in, content is opened and scripts are executed. These metrics show where deception takes hold: when the message is opened, at the click or when data is entered. That picture is the basis for recommendations that target specific processes and awareness gaps instead of generic advice.

At snapSEC, experienced red teamers plan and run the simulations, combining technical know-how with psychological insight. Our team brings more than 20 years of experience in IT security and simulates targeted attacks realistically but under control. Every scenario is designed individually for your organisation and takes its culture, processes and risks into account. Named contacts on your side stay involved during delivery, so it is always clear what is running.

A social engineering assessment focuses on people as the way in and measures how they respond to deception. Red teaming pursues a defined objective and combines social engineering and phishing with lateral movement and attacks on Active Directory, to test whether an attacker reaches the goal and whether your detection and response kick in. The assessment is therefore a focused starting point, red teaming a comprehensive test of your entire defence.

Yes. We can place prepared USB sticks, QR codes or similar media in office environments or ship them to your sites, and phishing campaigns work regardless of location anyway. That way even distributed organisations with several branches can be tested consistently and sites can be compared. Which sites take part and how the media are distributed is agreed with you during planning.