#4 Protect
Executive exposure
Executives’ home addresses are often easy to find online. We document what a stranger can learn about your leaders and their families, then remove as much of it as possible.
Details and case study →Services / #3 Expose
Social engineering exposure
Targeted phishing relies on research: who works where, how email addresses are formatted, who recently joined the finance team. We do that research first and show you how a targeted campaign against you would likely work.
What you get
Benefits
01
An attacker’s view of your staff
Which people, roles and details would make the most convincing lure, built only from what’s already public.
02
More relevant training
Awareness training is more effective when the examples show how your company would actually be targeted, not a generic gift-card scam.
03
Reconnaissance for red teams
Pen testers and red teams receive completed reconnaissance, so they can spend their time on the test itself.
04
Practical fixes
Most exposure comes from a handful of habits and settings. We name them and tell you how to change them.
What’s included
What We Do
- Staff and org-chart research from public sources
- Email format discovery
- Phishing risk rating with practical fixes
How it works
How It Runs
- Step 1
Scope
We agree in writing on the company, domains and teams in scope.
- Step 2
Research
We gather what’s public about your people, structure and email conventions.
- Step 3
Assess
We work out which roles are most exposed and how a targeted campaign would likely unfold.
- Step 4
Report
A report with a risk rating, example lures and a short list of fixes, plus a debrief.
Case study
Showing a finance firm how it would be phished
A wealth management firm wanted its phishing training to match the way an attacker would target it. Public research showed how easy it would be to impersonate its operations team.
Example engagement. The client is fictional and details are illustrative, to show how this work typically goes.
94%
of staff email addresses predictable from public info
3
roles identified as the most likely targets
5
fixes, most of them settings or habits
The situation
The firm ran annual phishing training with generic examples. Leadership wanted to know how a targeted attacker would come at them, especially around wire transfers.
What we did
We agreed on scope in writing: the firm’s domains and staff, public sources only, no contact with employees. We researched the firm’s people and structure using professional networking sites, the firm’s own website, regulatory filings, conference talks and breach data.
From that, we worked out the email format, which roles handle money movement, who they report to, and what a convincing lure would look like.
What we found
The email format was easy to work out and matched 94% of known addresses. Staff profiles laid out the operations team clearly, including who approves wire transfers. A recent conference talk by a senior advisor mentioned the firm’s custodian by name, which would make a fake “custodian update” email very believable.
What changed
We delivered a report with a risk rating, three example lures built from the research, and five fixes: tightening what staff list on public profiles, adding a call-back rule for payment changes, and setting up email authentication on two domains that lacked it. The firm used our example lures in its next training round.
Related services
Discuss this service with an analyst
Tell us about your situation. We’ll confirm whether this service fits and agree on scope and price before any work starts.