Phishing & spear phishing
Mass emails with fake login pages, or targeted messages to selected individuals and departments. Modern campaigns even defeat conventional multi-factor authentication using adversary-in-the-middle proxies.
Penetration Testing
Social Engineering Testing & Physical Pentests
Information security is a team effort
Attackers who fail at your firewall will try your employees instead – by email, over the phone, or right at the front door. Our authorized social engineering testing shows where manipulation would work in your organization and how to strengthen your processes, technology, and team with targeted measures.
- Fixed price after scoping
- Free retest of technical findings
- Quote within 24 hours
Definition
What is a social engineering pentest?
A social engineering pentest tests the human side of your information security. Instead of attacking servers and applications, we simulate the methods attackers use to trick employees into actions with serious consequences: a click on a malicious link, a password given out over the phone, a door politely held open. The goal isn’t to collect individual people’s mistakes but to make gaps in processes, controls, and training visible.
The human factor often decides whether an attack succeeds. Well-prepared employees are your most important success factor – whereas anyone who has never been made aware of manipulation almost inevitably becomes a risk. Many attacks start digitally; if the attacker gets stuck technically, they deliberately target your team. Without everyone’s vigilance, gaps remain that neither a firewall nor a policy can close on its own.
We test on three levels: digital, via email, SMS, messaging apps, and fake websites; analog, over the phone, by mail, or in face-to-face conversation; and physical, when it comes to entering buildings, offices, and server rooms. Depending on your goal, we combine the levels into an end-to-end scenario – just as a real attacker would.
For many companies, this is also a question of evidence: Art. 32 GDPR calls for a process for regularly testing the effectiveness of technical and organizational measures. ISO/IEC 27001:2022 provides for controls on security awareness (A.6.3) and physical security (A.7), and NIS2 explicitly names cyber hygiene and training as part of risk management. A social engineering pentest shows whether these measures actually work in everyday practice.
Our approach
How our social engineering testing works
Every test starts with reconnaissance – just like a real attack. Through OSINT research, we gather what is publicly known about your company: email formats, names and roles from professional networks, job postings, photos of buildings and ID badges. From this, we develop credible pretexts that fit your company – such as a follow-up question from a supposed supplier, a call from “IT support,” or a technician who claims to be servicing the fire alarm system.
Scenarios, time windows, and boundaries are set out in writing in advance, and you approve every pretext before it’s used. Only a small circle of insiders knows the date and procedure; a designated contact person can stop the test at any time. We carefully document every step and, at the end, evaluate which controls worked and where processes should be tightened.
Typical attack scenarios
Social engineering attacks we simulate for you
CEO fraud & whaling
Attackers pose as senior executives and pressure accounting or assistants into urgent, confidential wire transfers – or, in whaling, target the executives themselves. What matters is whether callback procedures and the four-eyes principle are followed even under time pressure.
Vishing
The supposed IT support calls and asks for a password, an MFA code, or the installation of a remote access tool. The service desk in particular is a lucrative target for fraudulently obtained password resets.
Smishing & quishing
Fake parcel text messages or QR codes on posters and letters lead to malicious pages – usually on smartphones that lie outside your central protection mechanisms.
USB baiting
A “lost” USB stick labeled “Payroll” in the parking lot. A double-click on the file it contains – or a stick disguised as a keyboard – can be enough to execute malicious code.
Pretexting
An invented but credible role – a tradesperson, an auditor, a new colleague, a courier – opens doors and elicits confidential information.
Tailgating
Someone who follows employees through a door with full hands or while chatting is rarely challenged. Smoking areas, delivery zones, and underground parking garages are classic weak spots.
Unprotected areas
Server rooms behind simple locks, cloneable access cards, live network jacks in meeting rooms, or confidential documents in the paper recycling.
Test types
Digital, analog, or physical – your focus
Digital
Digital SE pentest
Simulated attacks via email, SMS, messaging apps, and malicious websites – scalable from a pilot group to the entire company.
- Phishing, spear phishing, smishing, quishing
- MFA prompts and reporting channels put to the test
- Effectiveness of email filters and endpoint protection
Phone & personal contact
Analog SE pentest
Deception via traditional communication channels – over the phone, face to face at reception, or by mail.
- Vishing against the switchboard and service desk
- Pretexting with credible cover stories
- CEO fraud and callback procedures
On site
Physical penetration test
Our team tries to get into buildings, offices, and server rooms the way unauthorized persons would – with written authorization in hand.
- Tailgating and visitor processes
- Access cards, locks, and doors
- Network jacks, clean desk, and disposal
Process
Carefully planned, fairly conducted
A social engineering test intervenes in everyday work. That’s why we supplement our proven approach to penetration testing with particularly careful planning, clear authorization, and fair treatment of your employees.
-
01
Scoping
We clarify goals, sites, target groups, and test types and jointly define the circle of insiders. After scoping, you receive a fixed-price quote within 24 hours (on business days).
-
02
Authorization & framework
Written authorization from senior management, binding rules of engagement and abort criteria, and coordination with the works council or staff council, data protection, and – for rented premises – the property management.
-
03
Reconnaissance & scenarios
OSINT research, selection of the attack vectors, and development of the pretexts, which you approve before the start.
-
04
Execution
Phishing campaigns, calls, and on-site tests in the agreed time window – controlled, documented, and stoppable at any time.
-
05
Report & debrief
Anonymized evaluation, traceable attack chains, and prioritized measures. On request, we present the results to management and staff.
-
06
Retest & awareness
We retest fixed technical and physical vulnerabilities – for example, in the email filter, access control, or locking systems – free of charge. If needed, we plan a repeat of the phishing or on-site scenarios as a separate test. On request, we follow up directly with suitable awareness training.
Reporting
A report that improves processes – without exposing people
At the end, you receive a report that is equally clear to management and specialist departments. It shows which scenarios succeeded, where your controls worked, and which measures reduce the risk the most. By default, we present results in anonymized form at the level of departments and roles – the names of individual employees do not appear.
- Executive summary with an overall rating and risk classification
- Course of each scenario with timeline and attack chain
- Metrics such as click, submission, and reporting rates per area
- Photo documentation of physical vulnerabilities without identifiable persons
- Prioritized measures for processes, technology, and training
- Test certificate to present to customers, partners, insurers, and auditors
How well is your team prepared for manipulation?
A fairly planned test will show you – and deliver concrete starting points for processes, technology, and training. After scoping, you’ll receive a fixed-price quote within 24 hours (on business days).
FAQ
Frequently asked questions about social engineering testing
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Is social engineering testing legal in Germany?
Yes, if it’s properly commissioned. The basis is written authorization from senior management that defines the scope, time frame, and boundaries. For physical tests, it must also be clear who holds the right to control access to the premises (Hausrecht): in rented buildings, the property management or the owner often has to consent as well for the lobby, underground garage, or shared entrances. Without this permission, individual test activities could be a criminal offense, for example as trespassing (Hausfriedensbruch).
Does the works council have to be involved?
In many cases, yes. As soon as a test records the behavior of employees – such as clicks in a phishing campaign – co-determination rights under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG) may apply; in the public sector, the same applies to the staff council (Personalrat). We recommend involving the works council and the data protection officer early on, and in coordination with you, we provide the necessary information. Our anonymized-by-default evaluation makes this coordination much easier in practice.
Will mistakes have consequences for individual employees?
Not from our side. By default, we don’t name individuals; we evaluate by department and role. Anyone who falls for a well-crafted deception usually reveals a gap in processes or training – not a personal failure. We recommend communicating exactly that internally as well.
What are the limits of the tests?
We test as realistically as necessary and as gently as possible. By default: no scenarios that frighten or humiliate employees – such as fake terminations, salary promises, or personal emergencies – no real malware, and no storage of entered passwords; we only record that an entry was made. We don’t record phone calls, because doing so without consent would be a criminal offense (Section 201 of the German Criminal Code, StGB).
What happens if our test team is discovered on site?
Then your security organization has worked – and that’s exactly what we document. By default, our team carries an authorization letter with emergency contacts, which allows the engagement to be verified immediately. We behave cooperatively, de-escalate, and stop the test if necessary.
How do we prepare for the test?
Define a small circle of insiders, clarify who controls access to the premises at each site, and involve the works council and data protection. Your employees shouldn’t learn the date and scenarios in advance, as that would skew the results. On request, we sign a non-disclosure agreement before scoping.
How often should we test social engineering?
We recommend regular tests, for example annually, plus additional tests after major changes such as a move, a new access control system, or changed approval processes. A single test shows the current state; only repeated tests with varying scenarios make progress measurable.
Related pages
Plan your social engineering test with us
Tell us what you’d like to test – phishing, phone, physical access, or all of the above. We’ll get back to you with a proposal for scenarios, ground rules, and scope.