Speak to a pen test expert

Get in touch for a no obligation quote

1000 characters left
View our privacy policy


Customised real-life phishing exercises designed around your organisation

Psychological manipulation is a tactic commonly used by cybercriminals. By crafting emails and web pages that imitate those of known organisations and contacts, fraudsters aim to trick individuals into clicking dangerous links, opening malicious attachments, and disclosing personal details.

Redscan’s social engineering services allow you to accurately assess the ability of your systems and personnel to detect and respond to email phishing attacks. Gain precise insight into the potential risks through customised ethical hacking assessments created for your organisation.


Benefits of social engineering testing

Identifies risks posed

Understand how susceptible your employees are to falling foul of social engineering scams, such as spear phishing and Business Email Compromise attacks.

Reveals your information footprint

Learn what an attacker could glean about your organisation and employees from information freely available in the public domain.

Evaluates defences

Challenge your organisation’s cyber security controls to ensure they are effective at identifying and blocking phishing attacks.

Raises cyber awareness

A simulated phishing assessment can be used to highlight good and bad security practices as well as highlighting areas for improvement.

Enhances security training

The results of a simulated social engineering assessment can be used to improve employee security awareness training programmes.


Our phishing services


Phishing is one of the most common attack vectors used by cybercriminals. By creating emails that imitate those of trusted individuals and organisations, fraudsters seek to lure users into clicking malicious links and attachments or divulging sensitive information. A phishing simulation from Redscan assesses your employees' awareness of phishing email scams. A phishing test can be conducted as a standalone exercise or as part of a Red Team Operation.

Business Email Compromise

A Business Email Compromise (BEC) is a type of phishing scam involving the impersonation of a senior executive. The aim is to trick an employee, customer or supply chain partner into wiring payment for goods or services to an alternate bank account. Redscan’s social engineering service can be used to simulate a Business Email Compromise attack and test awareness of other fraudulent practices such as mandate fraud and distribution fraud.

Spear phishing-as-a-service

Spear phishing is a highly targeted phishing attack designed to compromise a specific individual, usually a system administrator or other high privilege user. Redscan’s spear phishing service tests the susceptibility of an agreed target to reveal confidential information.

Social engineering penetration testing

Social engineering is an attack vector that can be used as part of penetration testing assessments conducted by our team of CREST-certified ethical hackers.


Our social engineering approach

Redscan’s approach to social engineering mirrors the latest tactics used by fraudsters. A typical phishing assessment involves:

01. Reconnaissance
02. Mobilisation
03. Execution
04. Evaluation


By using open-source intelligence gathering techniques (OSINT), our team of ethical hackers seek to identify valuable company and employee information that could be used to target your organisation and improve the success rate of a simulated social engineering assessment.



Leveraging their knowledge of the latest social engineering tactics, our experts carefully prepare your phishing test to ensure that it is as authentic as possible and stands the best chance of achieving its objectives.



We execute the phishing test and, if part of the scope of the assessment, spoof any compromised users in order to escalate network privileges and make fraudulent requests, such as those common in distribution fraud and BEC attacks.



Upon completion of the social engineering operation, we document its results and provide prioritised recommendations to help address any identified risks and improve security awareness training programmes.

Request more information

Get in touch


Examples of successful
social engineering attacks

  • Italian football club Lazio lost €2m in 2018 after wiring a player transfer fee into a fraudster’s bank account
  • Dublin Zoo reportedly lost €500,000 after being targeted by a BEC Scam in 2017
  • MacEwan University in Canada lost $9.5m after staff failed to identify a phishing scam
  • Attackers compromised food retailer Chipotle's PoS systems to access customer payment card info in 2017

Types of penetration test

Network infrastructure testing

Network infrastructure testing

Redscan rigorously investigates your network to identify and exploit a wide range of security vulnerabilities. This enables us to establish if assets such as data can be compromised, classify the risks posed to your overall cyber security, prioritise vulnerabilities to be addressed, and recommend actions to mitigate risks identified.

Wireless testing

Wireless testing

Unsecured wireless networks can enable attackers to enter your network and steal valuable data. Wireless penetration testing identifies vulnerabilities, quantifies the damage these could cause and determines how they should be remediated.

Application and API security review

Application and API security review

Vulnerabilities contained within software are commonly exploited by cybercriminals and are easily introduced by under-pressure programmers. Redscan’s ethical hackers conduct automated and manual penetration tests to assess backend application logic and software and API source code.

Remote working assessment

Remote working assessment

If your organisation is embracing mass remote working for the first time, it’s important to ensure that it is doing so securely. Ensure your networks, applications and devices are protected and fully secured with a custom remote working security assessment.

Web application security testing

Web application security testing

Web applications play a vital role in business success and are an attractive target for cybercriminals. Redscan’s ethical hacking services include website and web app penetration testing to identify vulnerabilities including SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Social engineering

Social engineering

People continue to be one of the weakest links in an organisation’s cyber security. Redscan’s social engineering pen test service includes a range of email phishing engagements designed to assess the ability of your systems and personnel to detect and respond to a simulated attack exercise.

Mobile security testing

Mobile security testing

Mobile app usage is on the rise, with more and more companies enabling customers to conveniently access their services via tablets and smartphones. Redscan carries out in-depth mobile application assessments based on the latest development frameworks and security testing tools.

Firewall configuration review

Firewall configuration review

Firewall rule sets can quickly become outdated. Redscan’s penetration testers can detect unsafe configurations and recommend changes to optimise security and throughput.


Frequently asked questions about social engineering and phishing

What is social engineering?

Social engineering is an attack vector commonly used by cybercriminals to compromise the cyber security of organisations. The term describes the use of psychological manipulation as a means of tricking users into divulging sensitive information and/or performing adverse actions, such as opening malicious attachments.

What is phishing?

Phishing involves the large-scale dissemination of emails and other electronic communications designed to trick users into revealing sensitive details such as account passwords and credit card information.

Why is phishing commonly used by hackers?

People are often the weakest link in the security chain. Phishing enables criminals to target people on masse and harvest valuable information. The wide availability of phishing tools on the internet has enabled attackers with a low level of technical skill to conduct attacks.

How can businesses prevent phishing attacks?

Employee education, robust perimeter security, email authentication and proactive network and endpoint monitoring are just some of the measures that can help organisations achieve effective phishing attack prevention.

What is anti-phishing?

Anti-phishing is a collective term used to describe the tools and services available to help organisations identify and prevent phishing attacks.

What is baiting?

Baiting describes the psychological manipulation techniques cybercriminals use to trick people into disclosing sensitive information such as credentials for email and online banking accounts. Hackers go to great lengths to spoof well-known companies and devise fake offers, service updates and security alerts.

What is the difference between white-box and black-box testing?

Under a black box social engineering simulation, Redscan’s ethical hackers have no prior knowledge of your organisation’s environment. Reconnaissance is conducted to identify intelligence about employees and security controls in place. A white box testing approach is used in instances where phishing testing targets specific employees using pre-supplied email addresses.

Why choose Redscan?

A trusted partner for pen testing

  • One of the highest accredited UK pentesting companies
  • A deep understanding of how hackers operate
  • In-depth threat analysis and advice you can trust
  • Complete post-test care for effective risk remediation
  • Multi award-winning offensive security services
  • Avg. 9/10 customer satisfaction, 95% retention rate

            SC 2020 AwardsCyber Security Excellence Awards Winner 2020Teiss Awards 2020 WinnerComputing Awards 2019 Winner

What Our Customers Say

4.8/5 - based on 52 Reviews
“The penetration testing that Redscan performed provided some very credible findings and outlined clear improvements that we were able to implement. The whole process raised the bar of our cyber security defences.”
Head of Cyber Security
Specialist Bank
"Redscan gave us the professional service and quick turnaround that we needed to meet our tight deadlines."
IT Manager
Financial Markets Association
“Redscan’s hands on approach identified security flaws that had previously been overlooked by other vendors.”  
Technical Operations Manager
Spread Betting Firm
"Should I need any security testing again in the future, Redscan would be my first port of call!"
Project Analyst/Developer
Life Insurance Provider
“We have been very impressed by the quality of Redscan’s engagement, communication and reporting. We will not hesitate to use them for any future testing requirements.”      
Information Security Officer
Investment Advisory
“Redscan has given us a third party stamp of approval for our IT security and the reassurance to know we are as secure as possible.”
IT Manager
Investment Advisory

Get in touch

Complete the form for a prompt response from our team.

Two Redscan team members analysing cyber security intelligence

1000 characters left
View our privacy policy


Discover our latest content and resources

From the blog
From the blog Case studies Latest news
13th May 2024
Mobile banking malware rises by 32%
Global mobile banking malware has grown by 32% in comparison with 2022, according to new research. The report also highlighted a surge in attacks targeting Android users.
8th May 2024
Insider threats soar by 14% annually 
New research has highlighted a significant rise in insider or employee fraud, with the most common reason being “dishonest action to obtain benefit by theft or deception”.
8th May 2024
Two-thirds of organisations fail to address AI risks
New research suggests that, despite the soaring use of AI in the workplace, just a third of organisations are successfully addressing its security, privacy and ethical risks.    
29th April 2024
Security leaders anticipate daily AI-driven attacks by year-end
According to new research, the majority of businesses are worried about AI-enabled cyber-threats, with 93% of security leaders anticipating daily attacks of this type by the end of 2024.