Social Engineering Test

Want to test how well protected your organization is against cybercrime? At Tozettawe don't just test systems, we also test the human factor: through phishing, phone contact or a physical visit to your premises.

Discover below what a social engineering engagement can mean for your organization, from a low-threshold phishing test to a full physical and online attack simulation.

Get in touch Schedule an introduction »

Physical and online vulnerabilities mapped out
Creates awareness among employees
Transparent and clear process

Testing physical access during a Tozetta social engineering engagement

[ 01 ]Social Engineering

What is social engineering?

Social engineering is a specific form of cyberattack in which the human factor is exploited to gain access to information or systems. This can happen through phishing by phone or email, or someone physically trying to break in.

What is social engineering?

Social engineering is a specific form of cyberattack where not the technology, but the person is the target. An attacker tries to gain access to information, systems or buildings through deception, without needing to exploit a single software vulnerability.

How does an attack work?

Every engagement starts with OSINT: public information about the organization and employees. Based on that we build a credible scenario, which we then carry out via email, phone or a physical visit to your premises.

Who carries this out?

Our engagements are carried out by certified ethical hackers, the same professionals who also run your pentests. They work according to a pre-agreed scope and report objectively and discreetly.

[ 02 ]Attack types

Physical vs. online attack

A social engineering engagement can be carried out entirely remotely, or physically on location. Pick an attack type below and see which methods belong to it.

Digital attack, remote

In an online social engineering attack we approach your employees entirely remotely, via email or phone, to test whether they give away sensitive information or click a malicious link.

OSINT research

Gathering public information about employees and the organization to build a credible scenario.

Phishing attack

Sending a controlled phishing email to (part of) the organization to measure click behavior and reporting willingness.

Spearphishing

A personalized phishing email targeted at specific people or departments, tailored using OSINT information.

Vishing (phone phishing)

Contacting by phone under a false pretext to obtain confidential information or access.

Certifications

Our ethical hackers are broadly certified

From OffSec to Hack The Box: the Tozetta team sets the bar high with internationally recognized, hands-on certifications. We put that in-depth expertise to work in every pentest, so organizations can count on thorough, high-quality security research.

OSCP

Offensive Security Certified Professional

OSWE

Offensive Security Web Expert

OSEP

Offensive Security Experienced Penetration Tester

OSED

Offensive Security Exploit Developer

OSCE3

Offensive Security Certified Expert 3

CPTS

HTB Certified Penetration Testing Specialist

CWEE

HTB Certified Web Exploitation Expert

CWES

HTB Certified Web Exploitation Specialist

AED

Android Exploit Developer

APIsec

API Penetration Testing

eWPT

Web Application Penetration Tester

BED

Browser Exploit Design

Corelan

Windows Expert-Level Stack Exploit Dev

OSCP

Offensive Security Certified Professional

OSWE

Offensive Security Web Expert

OSEP

Offensive Security Experienced Penetration Tester

OSED

Offensive Security Exploit Developer

OSCE3

Offensive Security Certified Expert 3

CPTS

HTB Certified Penetration Testing Specialist

CWEE

HTB Certified Web Exploitation Expert

CWES

HTB Certified Web Exploitation Specialist

AED

Android Exploit Developer

APIsec

API Penetration Testing

eWPT

Web Application Penetration Tester

BED

Browser Exploit Design

Corelan

Windows Expert-Level Stack Exploit Dev

“An attacker doesn't just look at your systems, but at your entire organization. Where the technology is well secured, human behavior can offer another route inside. With social engineering we test that route in practice.”

[ 03 ]Why Tozetta

Why a social engineering engagement with Tozetta?

A social engineering test is a good way to reveal how vulnerable your employees and organization are to a cybercrime attack. At Tozetta a professional investigates how resilient your people are against deception, both online and physically on location.

A security awareness training is then one of the ways to make employees more aware of the risks and how they can respond.

Certified professionalsUnobtrusive & discreetObjective & confidential

Get in touch

[ 04 ]Our process

How does a social engineering engagement work?

Tozetta ethical hackers discussing the approach for a social engineering engagement

Introduction & scope

In a no-obligation conversation we determine together which scenarios, departments and attack types we test, physical and/or online.

OSINT & preparation

Our professionals gather public information and prepare a credible scenario, tailored to your organization.

Execution

The agreed attack is carried out, from a phishing email to a physical visit on location, with an eye for discretion.

Reporting & debrief

A clear report in Tozetta Reports, followed by a joint debrief and advice for next steps.

“I've capped off 5+ years of experience as an ethical hacker with an OSCP, OSED, OSWE, OSEP & OSCE3 certification. With that knowledge, I make sure your networks, websites, and mobile applications are tested thoroughly.”

[ 05 ]Investment

Social Engineering pricing

At Tozetta we want to be very transparent about the pricing of a Social Engineering engagement. From a low-threshold phishing test based on a single email to a full physical and online attack simulation.

Not sure which package fits you? Feel free to get in touch, custom work is also possible.

What does a social engineering engagement cost?

Social Engineering pricing

At Tozetta we bring the highest quality to every engagement. Every project comes with the following added value:

We always test with certified professionals
Every engagement starts with a no-obligation scope discussion
Extensive reporting including an improvement plan in Tozetta Reports
Personal debrief after completing the engagement
Discreet and carried out carefully, always within agreed boundaries

Social Engineering light

Low-threshold first introduction

€1295

1 phishing email to the whole organization
Fully online, no physical attack component
Overview of click and reporting behavior

Get in touch

Social Engineering basic

The standard phishing test

€1895

Basic OSINT research
Phishing attack
Physical letter mail

Get in touch

Social Engineering business

Focused on specific departments

€2695

Advanced OSINT research
Phishing attack
Spear phishing attack on two departments
Physical letter mail

Get in touch

Social Engineering professional

Full physical & online simulation

€4995

Advanced OSINT research
Spear phishing on every department
Physical visit by an actor
WiFi-spoofing
Physical letter mail

Get in touch

Frequently asked social engineering questions

What does the Social Engineering light package include?

The Social Engineering light package is a fully online test based on a single phishing email sent to the entire organization. This gives you low-threshold, affordable insight into employees’ click and reporting behavior, without a physical attack component. This package is ideal as a first introduction to social engineering testing.

What is WiFi-spoofing?

WiFi-spoofing is a technique in which an attacker creates a fake wireless network to trick users into connecting to it. The attacker sets up a wireless access point with a name that resembles a trusted network. This causes users to connect to the fake network. Once connected, the attacker can intercept and monitor the data sent between the user and the internet. This type of attack carries significant security risks, since it grants unauthorized access to sensitive information such as login credentials, personal data or financial information. Attackers can also launch further attacks, such as man-in-the-middle attacks, to manipulate or eavesdrop on the communication between the user and the intended destination.

What is Bluetooth Pentesting?

Bluetooth pentesting refers to carrying out a security assessment (pentest) on Bluetooth technology to identify weaknesses and vulnerabilities. During such a test, a security expert evaluates the Bluetooth implementation on devices such as smartphones, headsets or IoT devices to uncover potential risks. The test can involve various attack scenarios, such as pairing with devices without permission, intercepting Bluetooth traffic, or carrying out so-called "man-in-the-middle" attacks. Vulnerabilities in the Bluetooth implementation can lead to unauthorized access, data theft or a device being taken over by a malicious attacker.

What is Spear Phishing?

Spear phishing is an advanced form of online fraud in which attackers target specific individuals or organizations. Unlike generic phishing messages, spear phishing attacks are tailored to their targets. Attackers often use personalized information, such as names, job titles or recent activities, to win the victim's trust. This scam usually happens via emails, messages or social media. The ultimate goal is to lure the victim into revealing confidential information, such as login credentials or financial data, or to get them to open malicious attachments.

Ready to test your organization?

Get in touch without obligation and discuss the possibilities of a Social Engineering engagement.

Get in touch Schedule an introduction