Test how your people, processes and physical controls respond to realistic social engineering attacks before a real attacker puts them to the test.
Security Assessments & Simulations Delivered in the Past 5 Years
Social Engineering Projects Delivered in the Past 12 Months
Experience Across
Industry Sectors Each Year
The majority of recent high profile cyber attacks against top tier organisations have been successful because they have breached the perimeter through targeted social engineering attacks, otherwise known as ‘spear phishing’.
These attacks identify the contact details of potentially vulnerable people within the organisation and use a specially targeted attack vector which is likely to result in the execution of malicious code. Typically this involves crafting an email which would be of interest to the victim incorporating embedded malware, in the email itself or as an attachment.
We’ll help you design a realistic, controlled simulation around your people, systems and highest-risk scenarios
"*" indicates required fields
Once the code has been executed, it will then use network architecture weaknesses to establish command and control connections with the attacker who can then commence attacks on internal network resources. It is then generally straightforward to identify accessible stores of internal information assets (given access will have been gained with the credentials of the compromised user) and export them over the Internet using usually benign and innocuous protocols such as web connections.
Furthermore, other attack vectors often include using phone calls to staff, usually under the guise of IT personnel or a senior member of staff and attempting to entice them into performing a task that would also have adverse consequences for the organisation’s information security.
A defence-in-depth strategy for the protection of information assets should include all elements of security controls, including physical, procedural and technical. As such, it is essential that personnel within the organisation are adequately briefed on information security awareness, how to identify and report potentially malicious emails and the inherent risks associated with opening them.
The Prism Infosec simulation will effectively identify an organisation’s susceptibility to social engineering attacks, whether delivered via email, instant messaging, telephone calls or face-to-face within the client’s premises. As part of the assessment, we can use open source intelligence gathering to attempt to identify people within the organisation or target a specific team or function that the client determines should be the subject of the investigation.
We will then systematically target those individuals with a bespoke attack which we believe (in co-ordination with the client) has the highest probability of success. All attempts will incorporate a means to measure the success and may also determine whether it would be possible to breach the architecture and establish outbound command and control connections.
The output of the exercise shall position the effectiveness of information security awareness within the organisation, statistics on successful and unsuccessful attempts, details on whether it was possible to compromise the perimeter and to provide a detailed set of issues alongside pragmatic remedial activities that can be used to make improvements.
Email Prism Infosec, complete our Contact Us form or call us on 01242 652100 and ask for Sales to setup an initial discussion.
Supporting Transport for Wales with responsive, trusted cyber security expertise Transport for Wales (TfW) engaged Prism Infosec to provide services including security consultancy, advisory services, penetration testing and incident response support. Over more than a year, Prism Infosec has worked across a varied portfolio of projects, adapting quickly to complex requirements and short-notice demands. This has included supporting TfW through several smaller security incidents while meeting every agreed SLA.
Prism Infosec acts as an extension of TfW’s security team, combining responsive account management with clear, practical technical advice. As TfW’s requirements have evolved, Prism Infosec has adapted the service and delivered additional capabilities within the existing contract, ensuring support remains aligned with changing operational and security priorities.
The partnership is backed by an initial two-year commitment, reflecting a shared focus on continuity, responsiveness and long-term value. With a strong foundation already established, this is only the start of the relationship between TfW and Prism Infosec.
In most cases, no. To ensure realistic results, participants are not informed in advance of the specific timing or nature of the exercise. However, key stakeholders within your organisation will be briefed and involved in planning to ensure the simulation is conducted appropriately and safely.
Every engagement is carefully planned and governed by agreed rules of engagement. We work closely with you to define clear boundaries, minimise disruption, protect personal data, and ensure business-critical systems and processes are not negatively affected during the exercise.
Yes. We can simulate a range of social engineering techniques, including phishing emails, vishing (telephone-based attacks), SMS phishing, and physical access attempts. Scenarios can be delivered individually or combined to reflect realistic threat actor behaviour.
The objective is to assess security awareness and organisational resilience, not to single out individuals. If someone falls for the simulation, we document the outcome, identify lessons learned, and provide practical recommendations to strengthen awareness, training, and processes.
You will receive a detailed report outlining the scenarios used, key findings, success rates, observed vulnerabilities, and areas for improvement. We also provide clear, actionable recommendations to help strengthen your organisation’s resistance to social engineering attacks.
Absolutely. Every organisation faces different risks. We tailor scenarios to reflect your industry, business processes, culture, technology, and threat landscape, creating realistic and meaningful tests that align with your objectives.
Experiencing a security breach?
Contact the cyber security experts now
