Rules of engagement for a social engineering test

The rules of engagement are signed before anything runs. They record:

The authorisation letter is signed by someone with authority over the systems and premises in scope. For physical work the tester carries the letter on site. It names a contact who can confirm the engagement at any hour, and the guard or receptionist should ring that contact on a number taken from the organisation's own records. A number printed on the letter does not count.

In a shared building, written consent for lobbies, lifts and car parks the tenant does not control comes from whoever holds authority over those areas, usually the owner, body corporate or managing agent.

One decision needs to be made early. Allowlisting the simulation sender in the mail platform tests the people. Leaving it unallowlisted tests the filter as well. The rules of engagement record which one is being measured.

Channels can run together as one campaign or one at a time. Each one tests a different control, and the scope should follow the paths an attacker would use against your business and its suppliers.

Phishing, vishing, SMS and helpdesk testing run remotely and work the same way wherever you are based. Physical pretexting runs only at sites named in writing, and those sites can be anywhere in Australia.

Helpdesk testing exercises the recovery path that every other account control depends on. Publicly reported intrusions of recent years have begun with a call to a service desk. A reset or MFA re-enrolment granted without identity verification hands the attacker the account's own authentication, so controls that rely on that authentication no longer stop them.

A social engineering test follows the whole response path. It records whether a lure is recognised, whether it is reported, and how fast the report reaches someone who can act. Where a staff member complies, it records whether a control such as MFA, a callback check or a helpdesk identity check still stops the attempt.

Click rate mostly measures how good the lure was. The measures that predict how a real attack ends describe the organisation's response, so the report leads with those.

Nothing typed into a simulated login page is stored as a credential. The page records that a submission happened and when.

Before the test, the circle of people who know stays small. It is usually the sponsor, the security lead and one person who can stop the test. Where the helpdesk is in scope, the rules of engagement record whether the helpdesk manager is told, since a briefed manager can change how the desk behaves. Staff can be told in general terms that the organisation runs security testing under its policy, without dates or channels.

The board or its risk committee hears the purpose, the channels, the sign-off and the reporting basis before the test starts. Results will be given per team and no individual will be named. Stating this at the start lets directors back the test without worrying about how staff will be treated.

After the test, the sponsor gets a debrief first. Staff are then told the test ran and shown what the lures looked like, how to report one, and what the helpdesk or finance team will now ask for before acting. The awareness follow-up is written against the steps that failed. A second wave after training shows whether the change held.

The board summary reports the response measures, the findings by rating, an owner for each remediation item and the date of the second wave.

Every interaction is logged with its time and outcome, so the report can be checked against what happened. The evidence includes:

Findings are rated by what a real attacker could have done from the same point, and by the control that failed to stop them.

Findings are written against the control that failed: a missing verification step, an absent helpdesk script, or an alert that did not fire. The report is written for the people who own those steps: the helpdesk lead, the finance controller who approves payments, the facilities manager, and the executive who signs off the remediation. It carries enough detail to rebuild each step and to show the test to an insurer or a customer.

Social engineering findings provide evidence for controls in all three frameworks. The Essential Eight covers the technical controls a successful lure runs into. SMB1001 and ISO 27001 also cover awareness and reporting.

Where an organisation is working toward a maturity level or certification tier, the report can tag each finding with the control it evidences. That lets the auditor or assessor trace it directly.

Social engineering testing often runs alongside penetration testing and red teaming. Every test is quoted as a fixed scope based on the channels, headcount, sites, any on-site physical component and whether a second wave is included.