Practical Validation - Controlled Testing
Social Engineering Assessment
Cocoon tests whether your employees recognize and correctly report manipulation via phishing, phone, or physical lures.
- Tailored, realistic scenarios, from phishing to pretexting, executed within pre-agreed frameworks
- Assessment of recognition, willingness to report, and communication culture
- Report with concrete recommendations for training and procedures
What is a Social Engineering Assessment?
A Social Engineering Assessment is a practical test where Cocoon attempts to manipulate your organization’s employees into sharing confidential information, granting access, or performing an unsafe action, using realistic scenarios such as phishing, vishing, smishing, pretexting, or baiting. The test measures whether employees recognize, resist, and correctly report manipulation.
This service is relevant for any organization where people form the first line of defense against fraud, unauthorized access, or data breaches, with particular emphasis for finance, HR, and roles with access to sensitive information or systems. A Social Engineering Assessment is often deployed after a phishing incident, when there are doubts about employees’ willingness to report, or as part of a broader security awareness program.
How Cocoon Conducts a Social Engineering Assessment
Many alternative social engineering tests are limited to a generic phishing email sent to the entire organization, without follow-up or in-depth analysis. Cocoon employs realistic, customized scenarios and always links the outcomes to training and coaching, not to penalizing individual employees.
A Social Engineering Assessment at Cocoon also follows our established setup. During preparation, we jointly define the scope, target audience, and rules of engagement: which scenarios are permitted, what information may be requested, and how to handle employees who fall for the manipulation. During execution, our team deploys one or more scenarios, depending on your objectives.
Cocoon works with various forms of social engineering, each targeting a different channel and vulnerability.
Phishing is the most common form: an email that entices employees to click a link, open an attachment, or enter login credentials. We measure click, submission, and reporting rates and immediately identify the greatest vulnerability.
With vishing, one of our specialists approaches employees by phone with a credible pretext, for example, posing as IT support or a vendor, to obtain confidential information or access. This tests how employees react to pressure and urgency in a direct conversation.
Smishing occurs via SMS or chat messages and capitalizes on the speed with which people respond to mobile messages. This form is increasingly used alongside phishing, as employees are generally less alert to it.
With pretexting, our specialist builds a convincing, fabricated scenario, for example, posing as a new colleague, auditor, or vendor, to gain trust and subsequently obtain access or information. This form primarily tests the human tendency to be helpful.
With baiting, we place a physical lure, such as a USB stick or charging cable, to see if an employee picks it up and connects it. This reveals whether procedures exist against the use of unknown media or devices, and whether employees adhere to them.
After execution, a debriefing follows, where we discuss the findings directly with those involved and collectively examine what can be learned. Finally, you receive a report with findings, recognition percentages, and concrete recommendations for training, procedures, and awareness.
Why choose Cocoon
For Cocoon, a Social Engineering Assessment is not a one-time test of individual employees, but a starting point for structural improvement in security awareness. We do not evaluate our own provided security measures, which makes our findings objective. The outcomes are never used to penalize employees, but to provide targeted training and coaching.
- Independent validation, separate from provided security systems
- Custom scenarios, from phishing to physical baiting
- Directly linked to security awareness and coaching, never to employee penalization
Please note: under NIS2 and the General Security Requirements for Central Government Commissions (ABRO), actual testing of security measures is required.
Conducting a Social Engineering Assessment helps meet the requirements of NIS 2 and ABRO.
Cocoon works for renowned (publicly) listed companies in profit and non-profit environments; references are available upon request.
Frequently asked questions
How much does a Social Engineering Assessment cost?
The cost of a Social Engineering Assessment depends on the scope, the number of scenarios, and the size of the target group. Following the intake, you will receive a custom quote tailored to your objectives.
How long does a Social Engineering Assessment take?
A Social Engineering Assessment typically takes several weeks, from intake to reporting. The execution itself can be spread over multiple weeks, depending on the number of scenarios.
Is a Social Engineering Assessment Legal?
Yes. A Social Engineering Assessment is performed solely with the written consent of the client, within pre-defined Rules of Engagement. These guidelines ensure that the test is conducted lawfully and in a controlled manner.
What is the difference between a Social Engineering Assessment and a phishing test?
A phishing test focuses specifically on one channel: email. A Social Engineering Assessment is broader and combines phishing, vishing, smishing, pretexting, and baiting where relevant, depending on your objectives.
What is the difference between a Social Engineering Assessment and a Mystery Visit?
A Mystery Visit primarily tests physical access and reception processes through a single, discreet visit. A Social Engineering Assessment is broader: in addition to physical scenarios such as baiting, it also tests digital and telephonic manipulation, targeting the human element as a vulnerability regardless of the channel.
Are individual employees penalized based on the outcome?
No. The outcome is never used to evaluate or reprimand individual employees, but rather to specifically improve procedures, training, and security awareness.
Are Employees Aware of the Assessment?
No, this is intentional. Employees are not informed in advance so that the test measures their actual behavior. The client, however, is internally informed beforehand about the scope and scenarios.