Our social engineering services primarily aim to evaluate the human behavior of employees within an organization when faced with the most common social engineering attacks, thereby seeking to identify strengths and weaknesses in security policies, as well as their level of awareness and actual implementation.
Acknowledgement
Information gathering and target profiling
Exploitation
Execution of social engineering attack vectors
Documentation
Report with results, metrics, and recommendations
Service
What is a Social Engineering Testing?
A social engineering test is a security assessment that simulates attacks directed at an organization's personnel to verify how they react to deception and psychological manipulation.
Social engineering is a practice used to obtain confidential information by manipulating legitimate users: it targets user trust to see what sensitive information can be obtained, following a proprietary methodology developed based on internationally recognized social engineering techniques.
Confidential information is a key organizational asset through which fraud can be committed or unauthorized access to information systems can be obtained.
Attack vectors
Attack types
The types of attacks can be very varied:
Automated tools that collect emails from web search engines.
Social media searches for information posted by employees, collaborators, etc.
Phone calls impersonating key personnel, support, help desk, etc.
Physical access to facilities by validating access controls from the outside and the inside.
Phishing attacks.
Our services
How we work
The process to follow in a social engineering test is reflected in the following diagram:
Information gathering
Relationship building
Exploitation
Analysis
Documentation
Our Social Engineering projects follow a structured methodology that allows for a controlled assessment of the organization's level of resistance to manipulation techniques used by real attackers.
This approach provides a realistic understanding of user behavior in the face of manipulation attempts and strengthens the organization's ability to detect and respond to social engineering threats.
01Attack scenario analysis and design
We begin by conducting an analysis of the organization's environment, processes, and attack surface. Based on this information, we define the most appropriate attack strategy and the social engineering vectors that maximize the exercise's effectiveness.
02Scope definition and content validation
We establish the scope of the testing, identifying the groups or users who will participate in the exercise. We also validate the themes, messages, and pretexts that will be used during the simulations to ensure their realism and alignment with the organization's environment.
03Test planning and preparation
Before execution, all elements necessary for the campaign's development are prepared, adapted to the selected social engineering techniques:
Smishing: design and configuration of campaigns using simulated SMS messages.
Vishing: preparation of scripts and scenarios for controlled phone calls.
Phishing: development of emails, domains, and resources associated with the simulation.
Physical intrusion: planning of attempts to gain physical access to facilities or restricted areas.
04Execution of social engineering activities
Once the execution windows have been agreed upon, we carry out the various defined tests, which may include phone calls, SMS sending, phishing campaigns, or physical intrusion exercises.
05Analysis of results and final report
After the exercise is completed, we collect and analyze all the information obtained. The results are presented in an executive and technical report that includes:
Success indicators and metrics.
Detailed results by type of test.
Evidence obtained during the exercise.
Identification of detected weaknesses and risks.
Recommendations for improvement and awareness measures to reduce exposure to future attacks.
Email campaigns simulating real attacks, from mass phishing to targeted attacks on specific profiles within the organization, measuring open, click, and credential submission rates.
Vishing (voice phishing)
Phone calls impersonating key personnel, technical support, help desk, or other roles to obtain confidential information or unauthorized access.
Physical access
Attempts to access the organization's facilities by validating physical security controls, both from the outside and from within, including tailgating and in-person pretexting.
OSINT and reconnaissance
Collection of public information about the organization and its employees using automated tools, web search engines, social media, and open sources.
Pretexting and manipulation
Creation of credible scenarios and pretexts to manipulate employees and obtain confidential information, access, or unauthorized actions.
Measurement and awareness
Detailed metrics by attack vector, benchmarking against industry standards, and recommendations for security awareness and training programs.
What our clients say
Organizations that trust us
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.
Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.
CISO
RACC
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Yulian Colmenares
Information Security Office · Outsourcing SAS BIC
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.
Andrés Mejía
Head of GRC · Payválida
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set out by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% focused on e-commerce, the professional services provided by Internet Security Auditors give us support, security, and peace of mind that all of our activity is aligned with GDPR compliance.
Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain
As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
Sergio Sainz de la Maza
CISO · Intaremit
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their exhaustive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
Marcos Montes de Oca
CIO · Arbulu Group
As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
Miguel Acosta
Global CEO · Beruby
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that may affect the AR Construcciones brand and its various companies.
Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group
FAQ
Frequently Asked Questions
Is it necessary to inform the employees before the test?
It depends on the objective. In most cases, the tests are conducted without prior knowledge of the employees to obtain realistic results. Only a small group from management or the security team is informed. After the exercise, the results are communicated and awareness actions are carried out.
Are real data compromised during the test?
No. The objective is to measure employee susceptibility, not to compromise real data. Phishing campaigns use controlled capture pages, vishing calls document the information obtained without exfiltrating it, and physical access attempts are stopped once the control failure is demonstrated.
What metrics are obtained?
The report includes detailed metrics: email open rate, link click-through rate, credential submission percentage, average response time, success rate by department, comparison with industry benchmarks, and trends relative to previous tests, if any.
Can it be combined with a Red Team exercise?
Yes. Social engineering is one of the common vectors within a full Red Team exercise. It can be performed as a standalone service to measure the human factor, or as part of a broader exercise that combines technical and human vectors.
Does it include training recommendations?
Yes. The report includes specific recommendations to improve security awareness and training programs, tailored to the results obtained and the weaknesses identified during the test.
Contact
Do you want to evaluate your organization's resistance to social engineering?
Tell us your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.
A
Andrés Mejía
3 months ago
Your team combines solid technical expertise with a strong willingness for collaborative work, which has strengthened our security posture and regulatory compliance.
V
Victoria Villarreal Palazón
4 months ago
They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.
M
Miguel Acosta
5 months ago
The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
S
Sergio Sainz de la Maza
6 months ago
We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.
Request information
Global Presence
Our offices
Barcelona
C. Santander, 101. Building A-2 E-08030 Barcelona (Spain)
