Penetration Testing

Social Engineering Assessments

Controlled assessments evaluating organisational resilience to targeted manipulation techniques including phishing, vishing, and physical security.

4

Assessment Types

Controlled

Authorised Testing

Portal

Managed Delivery

Select a Service

Email Phishing

The Email Phishing Security Assessment evaluates an organisation’s exposure to phishing attacks delivered via email, focusing on both technical controls and user susceptibility.

Email Phishing Credential Harvesting Awareness Campaigns

View details →

Smishing (SMS Phishing)

The Smishing (SMS Phishing) Security Assessment evaluates an organisation’s exposure to phishing attacks delivered via SMS and mobile messaging platforms.

SMS Phishing Mobile Pretexting Campaigns

View details →

Vishing (Telephone Phishing)

The Vishing (Telephone Phishing) Security Assessment evaluates an organisation’s exposure to social engineering attacks conducted via telephone communications.

Telephone Social Engineering Voice Pretexting Scenarios

View details →

Physical

The Physical Security Assessment evaluates the effectiveness of physical controls designed to protect facilities, assets, and personnel from unauthorised access or interference.

Physical Access Control Tailgating Badge Cloning Site Assessment

View details →

Portal Access

Detailed Reporting

Remediation Guidance

Direct Communication

Attestation Letters

All services are delivered subject to formal scoping, contractual agreement, and explicit authorisation.

Get in Touch

If you would like to discuss an assessment or understand how Nanorisk can support your organisation, please get in touch.

Email Phishing Security Assessment

Service Overview

The Email Phishing Security Assessment evaluates an organisation’s exposure to phishing attacks delivered via email, focusing on both technical controls and user susceptibility.

The objective of this assessment is to identify weaknesses in email security controls and user awareness that could enable successful phishing-based compromise.

Scope & Focus

The assessment may include, but is not limited to, the evaluation of:

Email security gateway configuration and filtering controls
Authentication mechanisms such as SPF, DKIM, and DMARC
User awareness and response behaviours
Reporting and incident handling processes
Protection against common phishing and spoofing techniques
Monitoring and alerting capabilities
Integration with broader security operations
Alignment with recognised email security best practice

The specific scope is defined during formal engagement scoping and confirmed prior to commencement.

Engagement & Delivery

The Email Phishing Security Assessment is delivered under formal scoping and explicit authorisation and is managed through the Nanorisk Security Portal.

The assessment may combine:

controlled phishing simulations
configuration and control review

All activities are conducted in accordance with agreed rules of engagement and designed to minimise operational impact and user disruption.

Outputs & Reporting

Clients receive:

An Email Phishing Security Assessment report
Identified weaknesses with contextual risk explanation
Practical recommendations to reduce phishing-related risk
Secure access to findings and engagement artefacts via the Nanorisk Security Portal

Findings support improved resilience against email-based social engineering attacks.

Important Notes

This assessment focuses on preparedness and control effectiveness rather than blame or individual performance
Findings reflect a point-in-time view of phishing resilience during the assessment period
The assessment does not guarantee prevention of all phishing attacks

Vishing (Telephone Phishing) Security Assessment

Service Overview

The Vishing (Telephone Phishing) Security Assessment evaluates an organisation’s exposure to social engineering attacks conducted via telephone communications.

The objective of this assessment is to identify weaknesses in procedural controls and user awareness that could enable successful voice-based social engineering attacks.

Scope & Focus

The assessment may include, but is not limited to, the evaluation of:

User awareness and response behaviours
Verification and identity confirmation procedures
Call handling and escalation processes
Protection against caller spoofing and impersonation
Incident reporting and response mechanisms
Integration with security and fraud detection processes
Alignment with recognised social engineering defence best practice

The specific scope is defined during formal engagement scoping and confirmed prior to commencement.

Engagement & Delivery

The Vishing Security Assessment is delivered under formal scoping and explicit authorisation and is managed through the Nanorisk Security Portal.

The assessment may combine:

controlled vishing simulations
process and control review

All activities are conducted in accordance with agreed rules of engagement and designed to minimise operational impact and user disruption.

Outputs & Reporting

Clients receive:

A Vishing Security Assessment report
Identified weaknesses with contextual risk explanation
Practical recommendations to reduce voice-based social engineering risk
Secure access to findings and engagement artefacts via the Nanorisk Security Portal

Findings support improved resilience against telephone-based social engineering attacks.

Important Notes

This assessment focuses on preparedness and control effectiveness rather than individual performance
Findings reflect a point-in-time view of vishing resilience during the assessment period
The assessment does not guarantee prevention of all vishing attacks