Social engineering assessment services
A social engineering assessment is a consented, scoped exercise that sends your staff harmless imitations of phishing emails, calls and messages, then measures who acts on them, who reports them and how quickly your security team responds. BERRY9 runs each exercise under written authorization from a named executive and agreed rules of engagement, working from Hyderabad for organizations across India.
- Approach
- Consented, scoped simulation
- Measures
- Clicks, reports and response
- Controls
- Signed by a named executive
- Starts from
- INR 27,000 + 18% GST
Last reviewed
Illustrative The life of one consented exercise
Scope
Who, which channels, which dates.
Authorize
A named executive signs; HR and legal review.
Run
Simulated messages go out; a safe page records actions, never secrets.
Report
Clicks, reports and response time, summarized by group.
Follow up
Fixes to the reporting path, and short lessons from your own team where people slipped.
Example lifecycle, not a client engagement.
01 / What it tests
What a social engineering assessment tests
It tests people and the processes around them: whether staff recognize an attempt to deceive them, whether they report it, and whether the organization reacts in time.
Many attacks start with a person rather than a server: someone opens an attachment, approves a payment request that looks routine, reads a one-time code to a caller or plugs in a device found in the parking lot. Firewalls and patches do little about that. A social engineering assessment looks at this human layer directly. It sends your staff realistic but harmless attempts to deceive them, through the channels attackers use, and records what happens next: who ignored the attempt, who acted on it, who reported it and how quickly anyone in security heard about it.
The channels an exercise can use, each one agreed in writing beforehand:
Email phishing
Simulated emails that ask the reader to click a link, open a file or enter details on a page. The most common exercise, and usually the first one an organization runs.
Voice calls (vishing)
Phone calls in which a tester poses as someone with a plausible reason to ask for information or an action, such as a colleague, a supplier or a support desk.
Text messages (smishing)
SMS and messaging-app messages, which many Indian businesses rely on for work. They reach people away from the email filter, often on personal phones, so they need careful scoping.
Channels we run. BERRY9 runs email phishing, phone calls and text messages. On-site visits are not part of this service.
Each message or call is built around a theme, for example an internal notice, a supplier request, an account alert or an instruction that seems to come from a senior leader. Themes are chosen to match what your staff actually receive, and they are graded from easy to spot to hard to spot, so a result can be read against how difficult the attempt was. The wording of the messages and calls is agreed with your sponsor and kept out of public material such as this page.
02 / Outcomes
What a phishing simulation for employees measures
A good exercise produces more than a click rate. It shows how far a real attempt would have got, and how quickly the people who spotted it raised the alarm.
| Measure | What it records | Why it matters |
|---|---|---|
| Delivery | How many simulated messages reached an inbox or a phone | Shows the exercise was a fair test, and whether filtering stopped some of it |
| Click or reply | Who followed the link, opened the file or answered the message | The first point at which a real attacker would have gained something |
| Data entered | Who typed anything into the landing page, recorded as a yes or no only | The step that would hand an attacker an account or a code |
| Reported | Who used the reporting button, mailbox or helpdesk to flag the attempt | Every report is an early warning your security team could act on |
| Time to first report | How long after the first message the first report arrived | A fast report can stop a real campaign while it is still spreading |
| Response | What security or IT did with the reports they received | Reports only help if someone reads them and warns everyone else |
Watch the reports as closely as the clicks. Nobody gets a whole company to stop clicking. A workforce in which some people click but others report quickly, and the security team acts on those reports, is in a far better position than one where nobody clicks this time and nobody would think to report next time.
Email open rates are left out of the table on purpose. Many mail apps load images automatically or block them, so an "open" is a weak signal, useful as background but not as a result. A single round is also a snapshot: the numbers depend on the theme, the timing and how hard the attempt was. Results become meaningful when a later round with comparable difficulty shows whether behavior is changing.
03 / Rules of engagement
Rules of engagement for testing your own staff
Deceiving colleagues, even for their benefit, is only acceptable inside limits that the organization sets and signs first. These are the limits a professional exercise works within.
Show details for Rules of engagement for testing your own staff
- A named executive signs. Written authorization comes from a senior person who can approve testing of the staff, channels and premises in scope, and who is named in the document. A manager approving a test of their own team is not enough.
- Targets and channels are listed. The rules state which groups, offices or roles will be approached, through which channels, on which dates and at which hours, and who is left out, such as people on leave or going through a hard time.
- HR and legal review it first. Staff names, work email addresses and phone numbers are personal data, and some themes touch employment matters such as pay, appraisals or benefits. HR and legal agree what may be used, how the data is handled and how the exercise fits your policies.
- No real secrets are kept. If someone types a password or a code into a simulated page, the exercise records only that something was entered. The value itself is not stored, read or reused; personal accounts stay out of scope, and personal phones are included only where staff have agreed to it in advance.
- A safe landing page. Anyone who clicks reaches a page that does nothing harmful and can explain, on the spot, that this was a test and what to look for next time.
- A stop and reporting path. A contact on your side who knows about the exercise can confirm to the helpdesk whether a report is the test, pause it if a real attack or a real crisis begins, and support anyone who is upset by it.
- Results by group, not by name. Results are summarized by department, office or role. The purpose is to see where awareness and process need work, not to single out or punish the people who were deceived.
- Clean-up and deletion. Lists of targets and raw event data are kept only as long as the report needs them, then deleted as agreed, and any accounts, domains or pages created for the exercise are retired.
These limits are standard professional practice for authorized people-focused testing, and they are what separate a consented exercise from an attack on your own staff. They are written down and signed before the first message is sent.
Two questions deserve an answer before the exercise is planned. Should staff be told in general that simulations may happen, without being told when? Many organizations say so in their security policy, which keeps trust intact. And may a lure imitate a real outside brand, such as a bank or a delivery firm? Some organizations allow it and some prefer internal themes only; the choice goes into the rules.
04 / Planning
Planning the exercise with HR, legal and IT
A social engineering exercise touches more of your organization than a technical test does. Each team below has a decision to make before anything is sent.
Show details for Planning the exercise with HR, legal and IT
| Who | What they decide | Why it matters |
|---|---|---|
| Executive sponsor | Signs the authorization, approves themes and channels, receives the summary | Gives the exercise authority and someone accountable for it |
| HR | Which people and themes are appropriate, and how results will and will not be used | Protects staff, and trust in the security program, from an exercise that feels like a trap |
| Legal or compliance | Data handling, retention, brand imitation and any union or staff agreement terms | Keeps the exercise within your policies and contracts |
| IT and mail administrators | Delivery arrangements, the reporting mailbox and button, what the helpdesk tells callers | Lets the test measure people, not the mail filter, and lets real reports reach the right desk |
| Security team | Whether they are told in advance, and how they will handle reports during the window | Their response to staff reports is one of the things being measured |
What we need from you
- A signed authorization from a named executive
- The list of people, groups or offices in scope, and who is excluded
- The channels and dates you approve, and the hours to avoid
- Contacts in HR, legal, IT and security for the exercise window
- Your current reporting route, such as a mailbox or a button
Where the simulation runs. BERRY9 hosts the simulation and its landing pages.
How long it takes. Planning and approvals often take longer than sending the messages, and reports can keep arriving for days after a round. Planning dates and the length of each round are fixed in the proposal.
Hyderabad is our only office. If phone or message rounds are in scope, they are run remotely, and anything that would need a person at your site is planned on its own.
05 / Compared
Social engineering assessment vs red team vs awareness training
All three involve phishing, but they answer different questions: how a group behaves, whether one goal can be reached, and what staff know.
Show details for Social engineering assessment vs red team vs awareness training
Social engineering assessment
Measures how a defined group of people respond to deception. Every person in scope receives an attempt, and the result is a picture of behavior across the group.
Red team exercise
Pursues one objective, such as a named system or dataset, by any route the rules allow. People may be one route among several, approached only as far as the goal needs.
Awareness training
Teaches staff what to look for and what to do. It builds the skill; an assessment checks whether the skill shows up when a real-looking attempt lands.
The three are easy to confuse because they all involve phishing. A social engineering assessment is wide: it asks how the whole finance team, or every branch, responds, and it produces rates and patterns. A red team is narrow and deep: it may send a handful of messages to the few people who can open a door to its objective, then move on to systems, and it reports a path rather than a rate. Awareness training is teaching, not testing. A common pattern is training through the year, simulations from time to time, and a red team only once the basics are in place.
A social engineering assessment also sits beside technical testing rather than replacing it. If a phishing click would land on a laptop that can reach everything, that is a network problem, and the network penetration test is where it is found and fixed. All of the tests we offer are described in the offensive security services overview.
06 / Report
What the report tells you
The report turns individual actions into patterns by group, theme and channel, and ranks the changes most likely to improve the next result.
Show details for What the report tells you
The report is written for two readers. Leadership gets a short account of how the organization held up: what was tried, how many people acted on it, how many reported it, how fast security responded, and what should change first. The security and IT teams get the detail: the themes and channels used, how each group did against each one, which process weaknesses showed up, and a ranked list of actions.
Illustrative Observations a report might record:
| Observation | Kind | Suggested action |
|---|---|---|
| Reports reached the security mailbox, but nobody replied or warned other staff | Process | A response routine for reported messages, with a named owner |
| Staff in one office were more likely to enter details than elsewhere | Awareness, by group | A short session for that office, then a comparable round later |
| Many people wanted to report but could not find how | Process | A visible reporting button and one clear instruction |
| A caller posing as support was given a one-time code | Awareness, by role | A rule that codes are never shared, repeated by the helpdesk |
- An executive report that gives the headline results and the first changes to make, in language a board can use.
- An engineering report with group-level results by theme and channel, the process and technical weaknesses observed, and the evidence behind each one.
- A remediation matrix that ranks every action, from a missing reporting button to a helpdesk rule, so owners and dates can be set.
- Reporting by group: BERRY9 reports results by department or office, never by individual name.
Technical weaknesses found along the way, for example a mail setting that let a spoofed sender look internal, are written up in the same layout as findings from our other tests; the sample VAPT report shows that layout. Our VAPT methodology describes the scoping and reporting phases used here too.
People who were deceived are not failures of the exercise or of themselves. Attackers write convincing messages for a living, and the useful question is what helps the next person spot one and say so.
07 / Follow-up
Turning results into security awareness that lasts
An assessment that ends with the report wastes most of its value. The gains come from what changes afterwards in teaching, in process and in the next round.
Show details for Turning results into security awareness that lasts
Teach at the moment
The safe landing page explains the signs that were missed while the person still remembers the message. Explaining it then, while the message is fresh, tends to stick better than a reminder months later.
Fix the process
A reporting button that is easy to find, a helpdesk that confirms quickly, and a security team that warns everyone once a real attempt is reported. Fixes like these often change outcomes more than reminders do.
Run a comparable round
A later exercise with themes of similar difficulty shows whether clicks are falling and reports are rising, which is the evidence that awareness work is paying off.
Follow-up pays off when it is aimed. If one office or one role struggled with one kind of attempt, a short session for those people on that topic does more than another company-wide video. Where staff need deeper skills, such as developers, IT administrators or the people who handle incidents, our training for technical teams covers hands-on security work.
Follow-up sessions. Follow-up awareness sessions are not part of this service.
Some organizations also run these exercises to show customers or auditors that awareness is measured as well as taught. ISO/IEC 27001 includes information security awareness, education and training among its Annex A controls (control 6.3), and a measured result is one way to show that control working; read more on our ISO 27001 testing page.
08 / Price
What a social engineering assessment costs
A social engineering assessment starts from INR 27,000 + 18% GST; the final price is set in a written proposal after scoping. That figure is for the smallest scope: one channel, a modest group of people, and a single round. Wider or repeated work is priced to match.
Social engineering assessment
Starts fromINR 27,000 + 18% GST
The final price is set in a written proposal after scoping, once people, channels and rounds are agreed.
Request a scoping call- People in scope. A single team is a smaller exercise than every office, and larger groups need more coordination and a longer reporting window.
- Channels. Email alone is the simplest; phone calls and text messages are prepared and run one at a time.
- Rounds. One round gives a snapshot; a baseline followed by a comparable round gives a trend, at more cost.
- Languages and themes. Staff who work in languages other than English may need themes written for each, which adds preparation.
- Repeat round. A repeat round after the report can be part of the proposal or added later.
For how this compares with the price of our technical tests, see what VAPT costs in India.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
Social engineering assessments by city
09 / Inquiry
Tell us who and what you want to test
Tell us roughly how many people are involved, which channels worry you, whether you have run simulations before and who will sponsor the exercise. From there we can propose a scope and list the approvals to line up.
To talk it through first, call +91 86868 92922 or email contact@berry9.com.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
What is a social engineering assessment?
It is an authorized exercise that tests how an organization's people respond to deception. Staff in scope receive realistic but harmless attempts, such as simulated phishing emails, phone calls or text messages, and the exercise records who acted on them, who reported them and how the security team responded. The organization approves it in writing beforehand, and results are used to improve awareness and process rather than to blame individuals. See the section on What a social engineering assessment tests above.
How does a phishing simulation for employees work?
After the scope and approvals are agreed, simulated emails are sent to the people in scope over an agreed window. A link leads to a harmless page that records the action and explains the warning signs, and the exercise also tracks who reports the message through the normal route. At the end, results are summarized by group with recommendations, and a later round can show whether behavior has improved. See the section on What a phishing simulation for employees measures above.
How much does a social engineering assessment cost in India?
At BERRY9, a social engineering assessment starts from INR 27,000 + 18% GST; the final price is set in a written proposal after scoping. What moves it is how many people are in scope, the channels used, how many rounds are run, the languages the themes must be written in and whether a repeat round is included. See the section on What a social engineering assessment costs above.
Is it legal to run phishing tests on our own employees in India?
Organizations commonly run them as part of their security program, but the exercise should be authorized in writing by a senior executive and reviewed by HR and legal first. Staff contact details are personal data, so how they are used, stored and deleted should be agreed, and the themes should respect employment policies and any union or staff agreement terms. Your own legal counsel is the right person to confirm what applies to you. See the section on Rules of engagement for testing your own staff above.
Will employees who click be named or punished?
Professional practice is to report results by department, office or role, and to treat a click as a reason to teach rather than to punish. Naming and shaming tends to make people hide mistakes instead of reporting them, which is the opposite of what a security team needs. How results are used is your decision, and HR should settle it before the exercise begins. See the section on What the report tells you above.
What are vishing and smishing?
Vishing is voice phishing: an attacker phones someone and poses as a colleague, a supplier or a support desk to get information or an action. Smishing is the same idea by SMS or messaging app. Both reach people outside the email filter, so organizations that test only email miss part of the picture. In an assessment, both are run only with written approval for those channels. See the section on What a social engineering assessment tests above.
What happens if an employee types a password into the simulated page?
In a properly run exercise, the page records only that something was entered, never the value itself. Nothing typed is stored, read or reused. The person sees a short explanation that this was a test and what to watch for, and the result appears in the report as part of a group figure. See the section on Rules of engagement for testing your own staff above.
How is a social engineering assessment different from a red team exercise?
A social engineering assessment is broad: every person in scope receives an attempt, and the outcome is a picture of how the group behaves. A red team exercise pursues one objective, such as a particular system or dataset, and may approach a few people as one route toward it among several. A red team reports the path it took; a social engineering assessment reports rates and patterns. See the section on Social engineering assessment vs red team vs awareness training above.
Does a phishing simulation replace security awareness training?
No. Training teaches staff what to look for and what to do, while a simulation checks whether that teaching works in practice. The two belong together: the simulation shows where awareness is weak, and the training is then aimed at those groups and topics. See the section on Turning results into security awareness that lasts above.
Should staff be told before a phishing awareness test?
Telling staff the date defeats the purpose, but many organizations say in their security policy that simulations happen from time to time. That keeps the exercise honest without making it feel like a trick. The helpdesk and a small number of contacts usually know the window, so reports can be confirmed and anyone who is upset can be supported. See the section on Rules of engagement for testing your own staff above.
How often should a company run phishing simulations?
Often enough to see a trend, which means more than one round. A first exercise sets a baseline, and later rounds with themes of similar difficulty show whether clicks are falling and reports are rising. The right frequency depends on how quickly staff change, how often new people join and what your security program can follow up on.