Service

Social Engineering & Awareness

Controlled phishing, vishing and malicious QR campaigns that measure the human factor and turn it into a line of defense.

Human validation: Specialists design realistic scenarios for your industry and turn the results into concrete training.

Request a proposal

The challenge

Attackers don’t always break systems: sometimes they just ask for access

An email that looks like it comes from finance, a call from a supposed help desk technician or a QR code stuck at the reception desk can open the door that technology keeps shut.

Generic once-a-year training rarely changes behavior. What works is measuring how your people react to realistic lures and using those results to train each team where it is needed most.

We design and run controlled campaigns, with formal authorization and a learning-first approach: the goal is to strengthen people, not to expose them.

What we assess

Every channel an attacker uses to reach your people

We combine digital, phone and physical channels based on the real risks your organization faces.

Phishing simulation

Email campaigns at different levels of sophistication, from broad sends to spear phishing aimed at critical teams such as finance or IT.

Vishing

Simulated calls impersonating the help desk, vendors or executives, to measure whether identity is verified before information or access is handed over.

Malicious QR (quishing)

QR codes in emails, posters or documents that lead to controlled pages, to measure who scans them and enters their data.

Smishing and messaging

Text messages that mimic bank, courier or company notifications, an increasingly common vector on mobile devices.

Physical social engineering

Facility access tests —tailgating, visitor impersonation or USB drops— under strict rules and written authorization.

Awareness program

Ongoing training based on the results: micro-courses, team talks and materials tailored to your organization’s culture.

How we work

Realistic, controlled campaigns with a learning-first approach

Design and authorization

We define objectives, scope, scenarios and exclusions, with formal approval from leadership and coordination with HR and legal.

Realistic scenarios

We build pretexts based on real threats in your sector and on public information, without harming your brand’s or third parties’ reputation.

Controlled execution

We launch campaigns in stages and monitor the results. We record that data was entered, but we never store passwords.

Measurement

We analyze opens, clicks and data entry and, above all, how many people reported the attempt to the security team.

Just-in-time training

Anyone who falls for the simulation immediately gets a short explanation of the signs they should have noticed.

Follow-up

We repeat the measurements periodically to show each team’s progress and adjust the training.

Deliverables

Human risk indicators you can track over time

Reference frameworks

NIST SP 800-50
ISO/IEC 27001 (A.6.3)
MITRE ATT&CK T1566
SBS 504-2021

Campaign results reportOverall and per-team results, with the scenarios used and their level of sophistication.
Human risk indicatorsClick, credential submission and reporting rates, comparable across campaigns.
Scenario analysisWhich lures worked best and why, to prioritize training.
Awareness planContent, audiences and training calendar based on the results.
Training materialsMicro-courses, guides and communication pieces ready for your intranet or email.
Leadership briefingAn executive summary of human risk and its evolution, with recommendations.

Frequently asked questions

What clients usually ask before we start

Are employees who fall for the simulation exposed?

No. Results are reported in aggregate by team. Individual data is only shared if your internal policy provides for it, and always with a learning focus, never a punitive one.

Do you store the passwords people enter?

No. We record that a person entered data on the simulated page, but we do not store passwords or sensitive information.

Is it legal to run these tests?

Yes, with formal authorization from the organization. We coordinate with HR and legal, and we handle employees’ personal data in accordance with Peru’s Law No. 29733.

How often should we measure?

We recommend periodic campaigns throughout the year with varied scenarios, to track progress and keep staff from only learning to recognize one type of lure.

Does it include physical tests at our facilities?

Only if they are in scope. They are carried out with written authorization, clear rules and an authorization letter the consultant carries throughout the test.

Other services

Let’s define the right scope for your organization

Tell us about your objectives and constraints. We will send you a proposal with scope, rules of engagement, timeline and deliverables.

Talk to a specialist