Authorised social-engineering testing · Dublin
I test how organisations respond to phishing, before an attacker does.
Realistic pretexts, built from open-source intelligence and run under written authorisation, show how your people and processes behave when a message or a phone call isn’t what it seems.
Pretext design, response testing and debriefs
Pretext design
A pretext is the story that makes a request believable. I research an organisation from public sources and write scenarios that reflect what a real attacker could plausibly build, not a generic template.
Response testing
Phishing, vishing and smishing exercises, scoped and authorised in writing. I look at the whole response: who clicks, who reports, who challenges a caller, and how quickly the right people find out.
Findings and debrief
A plain-language report and a conversation with your team. The aim is to learn what the exercise shows about process and culture, not to name individuals.
How an engagement runs
- Scope and authorise. Objectives, boundaries and who is aware, agreed in writing.
- Research. Public information only, to build a scenario that fits the organisation.
- Run the exercise. Monitored throughout, with a clear way to stop it.
- Debrief. What happened, why it worked or didn’t, and what to change.
Recent writing on phishing and pretexting
- Have You Tried Hanging Up and Ringing Back?A “help desk” rings, knows your IT manager’s name and says your account locks at five. The phone scam hitting law and finance firms, and the one sentence that stops it.
- Invoice Fraud Has a New Target: The AI in Your InboxA fake CEO email now carries a hidden instruction for your AI assistant as well as your finance team.
- The calendar crookBonus letters, year-end invoices and tax deadlines: scammers don’t invent urgency, they borrow yours.
Start with a conversation
Tell me what prompted the question. We agree objectives, boundaries and authorisation before anything is tested.