Overview
Fraud in India often arrives as a phone call, an SMS with a short link, or an email that copies a vendor invoice or an official notice. Awareness training rarely mirrors those exact patterns. We design campaigns around the lures your people actually receive, in English and in regional languages where that adds realism, and report results by team rather than by named individual. Physical attempts are only included when agreed at scoping.
People are the vector most intrusions actually use, because a convincing message is cheaper and more reliable than a software exploit. A social engineering assessment measures how your organisation responds to that pressure: whether staff spot a crafted phishing email, resist a confident pretext phone call, or challenge someone attempting to follow them through a door. The aim is to understand real behaviour under realistic conditions, not to trick individuals.
We design scenarios that mirror the lures your people would genuinely face, agreed with you in advance and tuned to be realistic without being cruel. Email phishing campaigns measure not just who clicks but, just as importantly, who reports, since a workforce that raises the alarm quickly is more valuable than one that never clicks. Where in scope, we add voice pretext and physical access attempts, each run carefully and within clear, agreed boundaries.
The findings are deliberately constructive and never name individuals. We report rates and patterns, which departments and lure types performed well or poorly, how fast suspicious messages were reported, and where a reported attempt did or did not reach the right team. From that we recommend targeted awareness work and process changes, so the assessment leaves your people better prepared rather than simply judged.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scoping & consentWe agree vectors, scenarios, boundaries and no-blame principles in writing.
- Scenario designWe build realistic lures relevant to your people and sector.
- ExecutionCampaigns and attempts are run carefully within the agreed limits.
- MeasurementWe record click, report and response metrics by group and lure type.
- Report & awarenessWe deliver patterns, not names, with targeted awareness recommendations.
What you receive
- Click, submit and report rates by group and lure
- Analysis of reporting speed and process response
- Constructive findings that never identify individuals
- Targeted awareness and process recommendations
- Re-test option to measure improvement over time
Standards & frameworks
- MITRE ATT&CK
- NIST SP 800-115
- PTES
- OWASP WSTG
- CVSS v4.0
- CERT-In Audit Guidelines 2025
Frequently asked questions
Do you name the people who fail?
No. We report rates and patterns by group, never individuals, because a no-blame approach produces honest results and a willing workforce. Our goal is a team that reports faster next time, which naming and shaming actively undermines.
Is physical and phone testing always included?
Only where you want it and we agree it in scope. Email phishing is the most common starting point; voice pretext and physical attempts add depth but need extra planning and consent, so we scope them deliberately rather than by default.
How do you keep this ethical and legal?
Everything runs under written authorisation with agreed boundaries, named safety contacts and scenarios designed to measure behaviour, not to humiliate. We avoid lures that would cause genuine distress and stop immediately if an attempt risks real harm.
When do red team and phishing activities run?
During Indian business hours (IST) by default. Any evening, weekend or holiday activity is agreed in writing first, and your named escalation contact can pause the exercise at any point.
Can a red team exercise count towards a CERT-In audit?
Red teaming is listed as an audit type in CERT-In's 2025 guidelines, but those audits are meant to be done by empanelled auditors, and we do not claim empanelment. Tell us at scoping what the exercise is for and we will say clearly whether our work can serve that purpose.