Capability
Social Engineering
The attacks that make headlines right now rarely start with a zero-day. Our social engineering testing simulates exactly that. We target the human entry points your technical controls can’t reach.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
The threat
Social Engineering bypasses your technical controls.
Social engineering testing is an authorised engagement in which we use human deception techniques to validate whether your people, processes, and controls can be manipulated into giving an attacker access.
Threat actors know that the fastest route into your organisation isn’t through your firewall, it’s through your people. A well-constructed pretext, a name lifted from LinkedIn, and an urgency play is often all it takes. Your verification process was designed to be helpful.
People are unpredictable.
The colleague who questions a suspicious request at 9am approves the same one at 5pm. Humans are inconsistent. That’s the vulnerability.
Technical controls can’t keep up.
A firewall won’t block a convincing phone call. Your controls defend systems; social engineering targets the humans behind them.
Attack beyond the baseline.
We run the same attacks a real social engineer would, scoped to your environment, before a real attacker does. Every door we find, you close.
we attack the people you trust.
Real attackers don’t pick one technique and stop. They find a foothold and pull on everything connected to it. The Swarm works the same way.
Phishing and Spear-phishing
The email your team clicks. Bespoke pretexts targeted by role, context, and open-source intelligence, not template blasts.
Vishing (phone-based attacks)
The call that talks your helpdesk into a password reset or your finance team into a transfer. Scripted to your environment. Strategic and low-volume, simulating exactly how organised threat groups operate.
Pretexting and impersonation
A constructed identity with enough backstory to pass scrutiny. Built on real employee data gathered through open-source reconnaissance before a single call is made.
Verification bypass
Knowledge-based verification is the most consistently exploitable weakness we encounter. Testing whether your authentication and verification processes can be circumvented through research, rapport, and social manipulation, even when those processes look robust on paper.
MFA bypass and session theft
When your people are trained to approve push notifications, the authentication layer stops being a barrier. Adversary-in-the-middle techniques intercept the session before MFA completes, defeating authenticator apps without the user knowing anything went wrong.
Physical pretext and tailgating handoff
Where this discipline meets physical access. Once initial access is gained socially, the Swarm hands off to the physical security team for lateral movement, privilege escalation, and full compromise.
We know that real attack surfaces don’t come in neat categories. If yours doesn’t fit above, tell us what you’re working with.
What a Social Engineering Finding Looks Like
Example: Vishing engagement finding
Critical
Finding
A Swarm operator posed as an IT contractor and obtained a temporary VPN credential from the internal helpdesk in a single call. No verification protocol was triggered.
Impact
The credential provided access to internal systems for 72 hours before detection. Lateral movement to three internal systems confirmed.
Remediation
Implement a callback verification protocol for all credential reset requests.
Board impact
Staff approved a login they believed was legitimate, and the attacker reached systems that move money. The gap was process, not technology.
Technical impact
A temporary VPN credential obtained via a single helpdesk call gave authenticated access to internal systems. No verification protocol was triggered and no alert was raised.
Want the full picture?
The full range of offensive security the Swarm runs: every discipline, how they connect, and what each one tests.
No form fill required.
HOW WE attack SAFELY.
Your subscription starts with your Attack Strategy. What matters most, and what adversaries would target first.
Your Swarm then delivers realistic attacks against your whole organisation, and works within mutually agreed parameters without interruption to operations.
1
Authorisation
Every engagement is explicitly authorised in writing before anything begins. Scope, targets, and permitted techniques are defined and signed off.
2
Permission
Hard limits on permitted techniques with stop conditions documented. No psychological pressure beyond what is defined in the rules of engagement.
3
Care for the people
The outcome is organisational resilience, not individual blame. Findings are reported at team and process level.
4
Prove
What held, what broke, and what could have been reached. Board-ready evidence, and direct access to the people who found it, so you can do something about it.
Constant Cyber Attack™
We become the threat. You get the proof.
You don’t outpace attackers by waiting for your next test. You do it by facing an adversary that thinks, acts and strikes like they do.
CovertSwarm attacks your organisation the way the best attackers do: continuously, and using every tool available to reach their objective.
Digital. Social. Physical.
Your Swarm attacks across digital, physical and social vectors, chaining weaknesses to prove what a real attacker could achieve.
Constant pressure.
Your Swarm keeps attacking as your business evolves, adapting to changing systems, people and risks. Constant pressure, not a one-off test.
One simple subscription.
One subscription is all you need. Combine continuous offensive security, penetration testing, red teaming, bug bounty and more in one simple subscription.
Sharper, battle-tested SOC
Improve detection times
Fewer false positives
Prove ROI of security tooling
Stories from the Swarm
These stories are real, but the names are deeply redacted. We’ll tell you how we uncovered the threats no one else could see, and why constant cyber attack is the best way to outpace cyber threats.
Attackers go after people. We get there first.
Who in your business would an attacker go after, and what would they want? Talk to our team about what you need to protect and what you want to prove.
Together, we’ll set the objectives, scope and approach. Then we act on that intent on your terms, so you can close any way in before a real attacker finds it, with proof of what held.
Want that pressure on your people all year round? Explore Constant Cyber Attack
Frequently asked questions
Yes. Every CovertSwarm social engineering engagement is explicitly authorised in writing before any contact is made. Scope, targets, and permitted techniques are all defined and signed off by your team before anything begins. No engagement starts without that authorisation in place.
Close-knit teams aren’t safer, they’re often more vulnerable. Trust becomes an assumption and challenge becomes confrontation. Findings from a social engineering engagement are reported at team and process level, not attributed to individual employees. No staff member is named in a finding without explicit prior agreement. The outcome of the engagement is organisational resilience, not individual blame.
Scoping begins with a call to define the objective, the target population, the permitted techniques, and the rules of engagement. Hard limits and stop conditions are agreed and documented before any activity begins. The scope document is signed off by your team before the engagement starts.
Phishing simulation tools run automated, template-based campaigns at volume to generate click rates. A CovertSwarm social engineering engagement is different in every dimension: pretexts are built on open-source intelligence specific to your organisation, techniques go beyond email to include phone-based attacks and impersonation, and the objective is to find the specific access path an attacker would use, not to produce an awareness metric.
In a point-in-time engagement, social engineering is tested once within a defined window. Inside Constant Cyber Attack, social pressure runs as a continuous vector alongside digital and physical attack across your entire attack surface, with findings delivered on a rolling monthly cycle rather than in a single report.
No real credentials, personal data, or system access obtained during the engagement are retained after it closes. Data handling terms are defined in the rules of engagement document agreed before the engagement begins.
Honest answer: at minimum annually, more frequently after organisational changes or as part of a continuous programme.
Looking for something specific?
Talk to us. We’d love to hear from you.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.