Social engineering testing
Social engineering testing measures how your people respond to the techniques real attackers use to get in: targeted phishing, phone pretexting (vishing), fake recruiters, impersonated suppliers and messages on Telegram or LinkedIn. HYDN runs these campaigns with your agreement, measures who clicks, reports and escalates, and shows where process and training need to change.
Techniques we test
- Spear phishing. Emails written for specific people and roles, often leading to credential harvesting pages or malicious attachments.
- Vishing. Phone calls impersonating IT support, executives or suppliers to obtain access or approvals.
- Fake recruiters. Approaches through LinkedIn or messaging apps offering roles that require running code or opening files.
- Supplier and executive impersonation. Requests to change payment details or approve urgent transfers.
- Messaging apps. Telegram, Discord and similar channels where crypto teams do much of their work.
What we measure
- Who engaged with the lure, and how far they went.
- Who reported it, and how quickly.
- Whether the report reached someone who acted on it.
- Whether controls such as MFA, transaction approvals or endpoint protection stopped the attack anyway.
Why it matters
People remain the most reliable way into a well defended organisation, and testing them tells you more about your real posture than any scan. It is how Lazarus Group most often starts. See the Lazarus Group profile.
Frequently asked questions
Is this about catching out staff?
No. Results are reported in aggregate and focused on process. If one convincing email can move funds or grant access, that is a control problem, not a personal failing.
Can you simulate the fake recruiter campaigns aimed at crypto teams?
Yes, within agreed limits. It is one of the most effective techniques used against crypto developers, and testing whether staff would run an unknown 'technical assessment' is worthwhile.
Published Updated