The technology is secured, but an attacker simply asks a person for the password. I test whether processes and people withstand a targeted deception attempt, and turn the results into something the team can use.

You want to know how many employees fall for a well-made phishing email, and how many report it.
Payments, account changes or password resets are triggered by email or phone.
There has been an incident with fake invoices or a supposed call from management.
Awareness training should build on real results instead of generic slides.

Services

Phishing simulation

Campaigns with scenarios that fit your company and are agreed beforehand. We measure not only who clicks, but also who reports the email and how quickly the team responds.

Vishing and pretexting

Deception attempts by phone: a supposed IT support call, a supplier with new bank details, an urgent request from the top. These tests show whether call-back and approval processes work in everyday practice.

Review of approval and call-back processes

I review the processes attackers rely on: payment approvals, changes to master data, password resets at the help desk. A small process change is often more effective than any training.

Awareness training based on the results

The training picks up what actually worked in the test and shows concrete warning signs. That lasts longer than a standard course.

Fair and agreed

Every campaign is agreed in writing beforehand with management and, where one exists, with the works council.
The reporting never exposes individual employees. Results are given at the level of teams and processes.
The goal is a team that recognises and reports attacks, not a list of culprits.

Where technology can help, for example with phishing-resistant login using YubiKeys or passkeys, see IT security & IAM. If an account has already been taken over, IT forensics helps.

Social engineering and phishing simulation

When a social engineering test makes sense