Insider Threat & Social Engineering Assessments
Your strongest control is a person, and people can be called, emailed, and walked right past.
The most expensive firewall in the world is one helpful employee away from irrelevant. Attackers know this; it is usually the cheapest way in. I test the human layer the way they exploit it — the convincing email, the confident phone call, the person who holds the door.
This is done with care, because the people being tested are your people. The goal is never to humiliate anyone; it is to measure real susceptibility and build a culture and a program that make the next pretext fail. Insiders, too — I help you see the risk from the badge that already works.
- Targeted spear-phishing campaigns modeled on real adversary lures
- Voice phishing (vishing) and pretext calling against help desks and staff
- Physical social engineering and tailgating where authorized
- Credential-harvest and payload-simulation landing pages
- Executive and high-value-target (whaling) susceptibility testing
- Insider-threat risk modeling and detection-signal design
- Security-awareness program and metrics development
- Help-desk and identity-verification process hardening
Campaigns are authorized, scoped, and handled ethically — results are reported as rates and patterns, framed to improve the program, not to punish individuals. The output is a measurable baseline and a plan to move it, not a list of names to shame.
Every engagement runs under a signed NDA and, where testing is involved, a Safe Harbor agreement. Legal and ethical, start to finish.
- A susceptibility baseline across phishing, vishing, and physical vectors
- A prioritized human-layer remediation and awareness plan
- An insider-risk program design with practical detection signals
Will you single out employees who fail?+
No. Reporting is aggregate and constructive. The objective is a stronger program and culture, not individual blame, and campaigns are designed with that principle built in.
Can you test physical access too?+
Yes, where authorized in writing. Tailgating, pretext entry, and on-site testing are coordinated with named approvers and clear boundaries.
Hire me for Insider Threat.
Signed NDA and Safe Harbor on every engagement. Projects from five figures to nine. Discreet, relentless, done right.
I only do legal, ethical hacking — under a Safe Harbor contract and NDA.