Phishing assessments
Plan an authorised assessment with clear objectives, boundaries and escalation contacts.
What we examine
Agreed scenarios
Campaign design aligned with your testing objective.
Operational safeguards
Agree recipients, timing, technical scope and handling of campaign data.
Response assessment
Observe reporting and defensive workflows within the agreed scope.
Practical follow-up
Use the results to improve controls and awareness.
Test the response as well as the click
An authorised campaign examines reporting, triage and technical controls alongside user interactions. The report records user interaction, detection, reporting and the response timeline.
Information needed for a quote
Objective, recipient group, approved scenario, domains, timing and escalation contacts. Agree what is recorded, who can see it and retention. Collecting real passwords is not a default requirement.
Evidence included
The scenario, observable interactions, reporting outcomes and measurement limits. Recommendations can cover email controls, reporting routes, response procedures and targeted awareness work.
Scope, test, report.
Then verify the fixes.
Scoping, testing, reporting and verification, with direct access to the tester.
Agree the scope.
Applications, roles, access and deadlines. We agree the scope, fee and deliverables before testing.
Run the assessment.
Test the controls and the workflows around them. Significant findings are communicated during the engagement.
Document the findings.
Reproducible findings, demonstrated impact and practical recommendations for your developers.
Verify remediation.
Discuss remediation and validate agreed fixes. Retesting terms are set out in the proposal.