Advanced Attack: one story across channels, measured twice
We combine email, a call and physical presence in a single campaign, and we measure again. The retest is what separates it from a loose exercise. Enterprise includes one per year.
How we orchestrate an arc and not three loose attacks
We write a narrative that can live in email, in voice and, if it applies, in the building. Treasury, a branch and leadership do not get the same arc. The brief defines which channel opens and which closes.
We execute the vectors in the agreed window, with the same universe and the same ethical rule each channel would demand on its own. We log the gesture at each step, not a single “fail”.
A debrief with security. Pointed training on the gestures that failed. There is no ranking. There is a plan for the interval until the retest.
A second measurement on the same universe, with the story or a variant. We compare. That delta — not a market rate — is what the committee can read. Without a retest date there is no Advanced Attack: there is a one-night pentest.
Why a single shot does not serve the program
Because real fraud does not arrive in one envelope. The person who no longer opens an attachment will still take the call that “confirms the email” and will still accept an object the “vendor brought”. Measuring channels separately is…
What you get
Two pictures of the same universe and an arc the committee can follow, not three reports that do not speak.
Story design
Narrative, channels, roles and exclusions in writing. It includes the tentative retest date. Without that date scope is incomplete.
First wave executed
Email, phone and, if scope says so, physical presence, under one owner. It is not the sum of three loose purchase orders.
Arc report
Who failed at which step. Cut by area and by vector, read as a story. Not three stapled PDFs.
Retest and delta
A second measurement and a comparison. The deliverable a one-shot social pentest does not have. In Enterprise, the quota is one per year.
What we need from you
A counterpart who can sign a multi-channel story and a retest date. Without the second date we do not open the project: that would be selling a pentest under another name. Legal… Also clarity on what is out. This service does not replace a standalone USB drop or a standalone vishing: if you only need one channel, those pages are more honest. We do not ask…
How it fits the plan and the module
Advanced Attack does not replace native email campaigns. It is the major exercise, with a retest, that the module does not fire alone. In Enterprise the published quota is one per year; if the contract does not include…
Often contracted alongside this one
Questions about Advanced Attack
Measure the same story twice
If the program only has one-shot pictures, the committee cannot see habit. Let’s talk the arc and the return date.
Full catalog on Services