Phishing & Social Engineering Assessments

The most exploited attack vector

The vast majority of successful breaches begin with a human. Phishing campaigns, social engineering calls, and physical access attempts routinely bypass technical controls and reach your most sensitive data and systems. An independent test of your human defenses is no longer optional. It's a fundamental component of any mature security program.

Email phishing assessments

We design and execute staged email phishing campaigns, beginning with broad, easily-detected attacks and progressively escalating to highly-targeted spear-phishing using mimicked domains and custom pretexts. This reveals not just whether your users will fall victim, but at what level of sophistication your defenses will fail. You provide the list of recipients to include, so every target is one you have authorized.

Phone phishing (vishing)

Our engineers call your staff using a range of social engineering scenarios, posing as IT support, company leadership, or affiliated vendors. We call only numbers you provide and authorize; we do not source numbers ourselves, because a number found online could be a personal phone rather than a work line. Both live calls and automated scenarios are used, as each produces different results. All calls are non-disruptive, typically under a minute.

SMS phishing (smishing)

Text-based phishing is a growing and highly-effective attack vector. Many users apply far less skepticism to text messages than to email, making smishing assessments a valuable addition to any social engineering engagement. As with vishing, we test only client-provided, authorized numbers.

Physical and on-site social engineering

Physical and on-site social engineering assessments, including tailgating, impersonation, and facility access attempts, are available on a limited, case-by-case basis. They are not part of the online quote builder. If physical testing is a requirement for your program, contact us to discuss →

Post-assessment: security awareness training

The results of a real social engineering assessment are the single most effective input for security awareness training. Generic training videos are easy to ignore, but employees who were just fooled by a simulated phishing attack or a phone call pay very close attention to what follows.

Based in New York. Assessments Nationwide.

Grid32 conducts phishing, vishing, and smishing assessments for organizations across the United States, all conducted remotely with no geographic restrictions. Physical on-site social engineering assessments are available on a limited, case-by-case basis; contact us to discuss. We are particularly experienced working with financial institutions, law firms, and healthcare organizations navigating compliance-driven security programs.