SVC—11 · EXERCISE

Social-engineering exercise

The exercise measures a defined awareness or control objective. Its purpose is to improve defenses, never to embarrass people.

Start scoping

TEST BOUNDARY

What sits inside the boundary

Population, channels, languages, pretexts, and target behavior

Excluded people, sensitive topics, and escalation path

Data-capture limits, notifications, and wellbeing protections

ACCESS MODES

Knowledge level is scoped

Phishing simulation

Voice or messaging

Multi-channel campaign

DELIVERY—LEDGER

Deliverables you can inspect.

OUTPUT

Control and behavior outcomes without public shaming

Detection and reporting timeline

Process and training recommendations

EFFORT—DRIVER

Population, channels, and languages

Pretext complexity and approval chain

Data and employee-safety constraints

EXPLICIT—LIMIT

No coercion, protected-category targeting, or collection beyond the agreed minimum

Human resources and legal approval are required where applicable

POINT—IN—TIME

Precision includes what we do not claim.

A penetration test provides evidence about named assets, versions, access, and time. It does not guarantee the absence of vulnerabilities, replace internal vulnerability management, or constitute compliance certification.

Method and limitations

SCOPE—NEXT

Define the boundary before the fee.

Build a scope draft