Services
Testing that reflects how attackers actually work
Every engagement is agreed in writing first, with a defined scope and a way to stop it.
Pretext design and OSINT review
I look at what an attacker could learn about your organisation from public sources, and turn it into believable scenarios: a supplier query, a calendar invite, a call to the help desk.
- Review of the public footprint relevant to the exercise
- Written pretexts with the reasoning behind each
Phishing, vishing and smishing exercises
Controlled exercises across email, phone and text. I measure the whole response pathway, including reporting and escalation, not only who clicked.
- Email, voice and SMS scenarios
- Reporting and escalation behaviour, as well as click rates
- Live monitoring and an agreed stop condition
Debrief, reporting and re-test
A clear report, a conversation with the people involved, and where it helps, a later re-test to see what changed.
- Plain-language findings, ranked by what to fix first
- Practical recommendations for process and training
- Optional re-test
Start with a conversation
Tell me what prompted the question. We agree objectives, boundaries and authorisation before anything is tested.