Overview
People-focused testing in the UK has to respect employment practice and data protection as well as security goals. We agree scenarios with HR and the security lead, keep results at team level unless you ask otherwise, and handle staff data under UK GDPR principles. The output shows where processes broke down, not who to blame.
People are the vector most intrusions actually use, because a convincing message is cheaper and more reliable than a software exploit. A social engineering assessment measures how your organisation responds to that pressure: whether staff spot a crafted phishing email, resist a confident pretext phone call, or challenge someone attempting to follow them through a door. The aim is to understand real behaviour under realistic conditions, not to trick individuals.
We design scenarios that mirror the lures your people would realistically face, agreed with you in advance and tuned to be realistic without being cruel. Email phishing campaigns measure not just who clicks but, just as importantly, who reports, since a workforce that raises the alarm quickly is more valuable than one that never clicks. Where in scope, we add voice pretext and physical access attempts, each run carefully and within clear, agreed boundaries.
The findings are deliberately constructive and never name individuals. We report rates and patterns, which departments and lure types performed well or poorly, how fast suspicious messages were reported, and where a reported attempt did or did not reach the right team. From that we recommend targeted awareness work and process changes, so the assessment leaves your people better prepared rather than simply judged.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scoping & consentWe agree vectors, scenarios, boundaries and no-blame principles in writing.
- Scenario designWe build realistic lures relevant to your people and sector.
- ExecutionCampaigns and attempts are run carefully within the agreed limits.
- MeasurementWe record click, report and response metrics by group and lure type.
- Report & awarenessWe deliver patterns, not names, with targeted awareness recommendations.
What you receive
- Click, submit and report rates by group and lure
- Analysis of reporting speed and process response
- Constructive findings that never identify individuals
- Targeted awareness and process recommendations
- Re-test option to measure improvement over time
Standards & frameworks
- MITRE ATT&CK
- NIST SP 800-115
- PTES
- OWASP WSTG
- CVSS v4.0
- FCA/PRA operational resilience (SYSC 15A)
Frequently asked questions
Do you name the people who fail?
No. We report rates and patterns by group, never individuals, because a no-blame approach produces honest results and a willing workforce. Our goal is a team that reports faster next time, which naming and shaming actively undermines.
Is physical and phone testing always included?
Only where you want it and we agree it in scope. Email phishing is the most common starting point; voice pretext and physical attempts add depth but need extra planning and consent, so we scope them deliberately rather than by default.
How do you keep this ethical and legal?
Everything runs under written authorisation with agreed boundaries, named safety contacts and scenarios designed to measure behaviour, not to humiliate. We avoid lures that would cause genuine distress and stop immediately if an attempt risks real harm.
Is your red teaming a CBEST engagement?
No. CBEST is the Bank of England's intelligence-led testing framework and has its own provider requirements. We don't claim to meet them. If a regulator has asked for CBEST, tell us at scoping and we'll say plainly whether we can help with any related work.
Can these exercises support FCA and PRA operational resilience work?
They can feed it. Firms under SYSC 15A identify important business services, set impact tolerances and run scenario testing. A red or purple team exercise aimed at one of those services gives realistic evidence about detection and recovery.