The premise
Software gets patched. Habits don't.
Most organizations spend their security budget on firewalls and endpoint tools, then leave the front desk, the phone line, and the server-room door to good intentions. That is where modern attacks actually land. A confident voice asking for a password reset outperforms a zero-day, and it costs the attacker nothing.
What we test
Three ways a stranger reaches what matters.
Voice
Vishing
A phone call under a pretext, aimed at your staff, to measure whether trust alone opens a door before anyone verifies.
Phishing
Simulated campaigns that track who clicks, who reports, and how both numbers move as your people learn.
Physical
Access
A plausible visitor testing whether your reception, your floors, and the rooms that hold your data actually hold.
The blind spot
Your cameras watch the doors. Attackers use the phone.
How a campaign works
Authorization comes first, always.
Authorize
Nothing begins without written permission from someone who controls the asset. We confirm that authority covers every door and system in scope, and we refuse work we cannot do lawfully.
Scope
We agree in writing what is in bounds, who stays informed, and the signal that stops the test. A single point of contact can vouch for our operator the moment anyone challenges them.
Operate
We run the campaign with benign proof and continuous recording. A photograph of a locked screen, an audit sticker on a network port. We document that access was possible, never the data behind it.
Debrief
You get a plain account of what worked, what held, and what to fix. Findings name process gaps, never individuals. No one on your team is identified or blamed.
Who it's for
Mid-market firms with real money in motion.
The attacker rarely wants what you make. They want the desk that authorizes your payments and a foothold to shut you down. We test the organizations where that exposure is largest and the defences are thinnest.
How we work
The rules are the product.
Authorized
Permission, in writing, first.
The organization signs off before a single call is placed or a door is tried. The authorization letter travels on our operator, not in a filing cabinet.
Benign
Proof without exposure.
We prove access with a marker and a timestamp. We never view, copy, or store your credentials or your clients' data to make a point.
Fair
No one gets thrown under the bus.
A tricked employee is a training moment, not a target. Reports describe the gap and leave the person out of it.
Start here