Social Engineering Penetration Testing Guide

Social engineering penetration testing measures whether your people and processes hold up against the techniques attackers actually use to get in. Most breaches still begin with a human, a clicked link, a convincing phone call, or someone holding a door, not with a zero-day. So a test that ignores the human layer ignores the most common entry point.

This guide covers the four channels (phishing, vishing, smishing, and physical), the tools that run them, how to write rules of engagement that keep the test ethical and legal, and the metrics that tell you whether the organization is improving. It treats social engineering as one piece of a broader offensive program, closely tied to red team work.

What is social engineering penetration testing?

Social engineering penetration testing is an authorized assessment that uses deception to test whether employees and processes can be manipulated into granting access, revealing credentials, or performing harmful actions. It targets the human layer instead of (or before) the technical one, simulating the methods a real attacker uses to gain an initial foothold.

It is usually one component of a wider engagement. On its own it produces a phishing or pretexting assessment; combined with technical exploitation and post-compromise activity it becomes a full red team assessment. Either way it complements rather than replaces technical testing across the types of penetration testing an organization runs.

What are the main social engineering attack vectors?

There are four primary channels, and a good program tests more than one because attackers do. Phishing (email) is the most common and most scalable. Vishing (voice) uses a phone call to extract information or push an action, often impersonating IT or a vendor. Smishing (SMS) exploits the trust and urgency of text messages. Physical social engineering puts an assessor on-site to tailgate, drop devices, or talk past reception.

Each relies on the same psychological levers: authority, urgency, fear, and familiarity. The channel changes the delivery and the controls you are testing, but the pretext (the believable story behind the attack) is what makes any of them work.

• Phishing: bulk or targeted email, including spear-phishing of specific roles.
• Vishing: phone-based pretexting against helpdesks and individuals.
• Smishing: SMS lures, often for credential capture or malicious links.
• Physical: tailgating, badge cloning, USB drops, and pretext visits.

How does social engineering map to MITRE ATT&CK?

Social engineering primarily maps to the MITRE ATT&CK initial-access tactic, which covers how adversaries get their first foothold. Phishing (T1566) and its sub-techniques (spearphishing attachment, link, and via service) are the headline entries, and they are among the most-used techniques in real intrusions.

Framing your test against ATT&CK does two things. It lets the blue team measure detection and response against the exact techniques you simulated, and it connects the human entry point to everything that follows, lateral movement, privilege escalation, and exfiltration. That continuity is why social engineering belongs in an adversary-emulation program rather than as a standalone stunt, and why teams increasingly run it continuously, as we describe in our guide to agentic pentesting.

What tools are used for social engineering tests?

The toolset depends on the channel. For email phishing campaigns, GoPhish and King Phisher handle template design, sending, landing pages, and per-target tracking of opens, clicks, and submissions. The Social-Engineer Toolkit (SET) generates payloads and cloned login pages for more hands-on attacks.

When the target has multi-factor authentication, Evilginx2 is the tool that matters: it acts as a reverse proxy between the victim and the real login page, capturing both credentials and the authenticated session cookie, which defeats most app-based and SMS MFA. That capability is exactly why phishing-resistant authentication (FIDO2/WebAuthn) is the recommended fix in nearly every report.

• GoPhish / King Phisher: campaign management, tracking, and metrics.
• Evilginx2: reverse-proxy phishing that captures MFA session tokens.
• SET: payloads, cloned pages, and quick attack scaffolding.
• Supporting recon: OSINT for targets, lookalike domains, and pretext detail.

Why do rules of engagement matter so much?

Rules of engagement matter because social engineering targets people, which creates legal, ethical, and HR risk that technical testing usually does not. Written authorization is non-negotiable, and the ROE must define exactly what is in scope, what is off-limits, and how the assessment protects the individuals involved.

At minimum, agree on: the in-scope channels and target groups, explicit exclusions (no threats, no real harm, no exploiting personal crises), the physical-test safe word and emergency contacts, how captured credentials and PII are stored and destroyed, and a clear get-out-of-jail letter for on-site assessors. The aim is to measure the organization, never to punish an individual, so findings should be reported in aggregate.

• Signed authorization and a physical get-out-of-jail letter.
• Defined scope, target groups, and hard exclusions.
• Safe word and live emergency contacts for physical work.
• Strict handling and destruction of captured credentials and PII.

How do you measure social engineering results?

Measure the funnel, not just the failures. For phishing, the core metrics are delivery rate, open rate, click rate, and credential-submit rate, which tell you how far an attack progressed. But the most important number is the report rate: how many people flagged the message to security, and how fast.

A high click rate with a fast, high report rate is a healthier outcome than a low click rate and near-zero reporting, because real resilience is detection and response, not perfection. Track trends across repeated tests rather than obsessing over one campaign, and feed results into targeted training and into technical fixes like phishing-resistant MFA and better email filtering. Tie remediation back into the same queue you use for findings across your other network and infrastructure tests.

Frequently asked questions

Sources and references

• MITRE ATT&CK: Phishing (T1566)
• GoPhish Open-Source Phishing Framework
• Evilginx2
• CISA: Avoiding Social Engineering and Phishing Attacks