Book a scoping callBook a call

Measure the human layer with care

Controlled phishing campaigns measure how people and reporting paths respond. Targets, privacy rules and safe payloads are agreed before anything is sent.

The pretext

A believable pretext with a measurable response

We craft a pretext that fits your organisation, send it to the agreed audience and record delivery, interaction and reporting. The debrief focuses on controls, reporting paths and coaching.

IT Service Desk
no-reply@acme-hr-portal.com
lookalike
Action required: your password expires today

Your account will be locked in 2 hours. Verify your credentials now to keep access to email and payroll.

Verify my account
↳ links to acme-hr-portal.com/login, credential capture
campaign funnel
Delivered
Opened
Clicked the link
Entered credentials
Reported to IT
SignalThe people who spotted it and reported. The outcome that actually shrinks your risk.
What we look for

What the campaign measures

Every campaign is run to an agreed rules-of-engagement plan, with safe payloads and no individual named. It measures susceptibility and response, never scoring your people.

Targeted phishing and pretext campaigns

believable emails and scenarios built from public detail about your org.

Credential harvesting and MFA fatigue

fake login pages, and push-bombing that wears someone into approving.

Payload delivery and execution rates

who opens, and who runs the attachment, on agreed-safe payloads.

Reporting behaviour and response time

who reports it, through what channel, and how quickly.

Awareness gaps, framed constructively

where training should go next, never named-and-shamed individuals.

5 checks
Targeted phishing and pretext campaigns

believable emails and scenarios built from public detail about your org.

Credential harvesting and MFA fatigue

fake login pages, and push-bombing that wears someone into approving.

Payload delivery and execution rates

who opens, and who runs the attachment, on agreed-safe payloads.

Reporting behaviour and response time

who reports it, through what channel, and how quickly.

Awareness gaps, framed constructively

where training should go next, never named-and-shamed individuals.

How we test

Agree the safeguards, run the campaign and coach from the result

Step 01

Agree scope & ethics

Targets, pretexts and boundaries decided with you before anything is sent.

Step 02

Run the campaign

Controlled, measured and safe for your staff, with a real, believable lure.

Step 03

Report & coach

We report the agreed measures, identify useful patterns and turn them into practical coaching.

What you get

Campaign results designed for coaching

01

Campaign results with click and report rates

The full funnel, delivered to reported, with the numbers that matter most.

02

Pattern analysis under the agreed reporting model

The engagement defines in advance how results are grouped and who can see them.

03

Awareness recommendations

Practical coaching that raises the report rate, the metric that reduces risk.

Outer Core records campaign delivery, interactions and reports as the engagement runs. Visibility follows the privacy and reporting rules agreed before the campaign.

See how delivery works
Get started

Test the human layer, kindly, and for real

Social engineering is scoped per engagement. Book a call and we'll agree targets, pretexts and boundaries, with your people's dignity built in.

Book a scoping call