Phishing and the human factor
We assess staff readiness through agreed phishing and social-engineering exercises, helping improve how suspicious messages are recognised, reported and handled.
01 / ASSESSMENT
Phishing uses deceptive messages or pages to mislead staff. Management-approved simulations assess recognition, reporting and requests for help. Real passwords are not collected; findings support targeted training rather than blame.
PRACTICAL SCENARIOS / TTP
TTPs are an adversary’s tactics, techniques and procedures. We analyse these approaches and select scenarios for your environment and the scope agreed in writing, connecting each assessment result to practical defensive guidance.
A business email compromise scenario simulates urgent payment or bank-detail changes. Assess recognition, independent verification and escalation. No real transfer is performed; findings improve the payment process.
Select relevant lures such as QR links, file-sharing notices or convincing AI-assisted messages. Do not collect real passwords or one-time codes. Measure recognised warning signs and correct reporting of suspicious messages.
Click rate alone is insufficient: reporting speed, verification habits and support channels matter too. Turn results into department-specific learning. Repeat exercises measure improvement rather than punish staff.
02 / OUTCOMES
Work proceeds under the system owner’s written authorisation, a contract and a confidentiality agreement. Assets, methods, timing, stop conditions and data handling are defined before work begins.
Send your requirements through CyberTrust. We will clarify asset count, assessment depth and expected outcomes with you, then set out timing and pricing in the proposal.