Social Engineering Testing and Red Team Exercises Phishing, vishing, pretext calls, adversary simulation and purple team work, run under written authorization

01Definitions

What social engineering testing, red teaming and purple teaming mean

Social engineering is the use of deception to get people to do something they should not: click a link, enter a password, approve a payment, reset an account, open a door or share information. It works because organizations depend on staff being helpful, responsive and trusting. Most serious breaches involve a human step somewhere, whether a phishing email that harvested credentials or a phone call that persuaded a help desk to reset a password.

Social engineering testing measures that exposure safely. Consultants send authorized phishing emails, make authorized pretext calls, send text messages or visit premises with an approved story, and record how staff and processes respond. The aim is not to catch people out. It is to find out which processes rely on luck rather than verification, which warning signs staff recognize and which they miss, and whether suspicious activity gets reported quickly enough for the security team to act.

A red team exercise is broader. It simulates a realistic adversary pursuing specific objectives, such as reaching a payment system, a research database or an executive's mailbox, using whatever combination of social engineering, technical attack and physical access the rules allow. The defenders are usually not told. A purple team exercise uses the same attack techniques but works openly with the defenders, testing and improving detection one technique at a time.

02Who runs it

Who conducts Delator's exercises, and on what authorization?

Social engineering and red team work are not private investigation, and Delator does not refer them to its investigator network. Delator's own consultants design and run every exercise. The team brings together people with U.S. military intelligence and Department of Homeland Security backgrounds, former law enforcement officers from many kinds of agencies, former bail enforcement agents with long practical experience of persuading people to share information, and technology specialists across email security, identity, endpoint defence, networks and cloud.

Authority comes from a written authorization signed by someone who can bind the organization, usually a senior executive with the chief information security officer, general counsel or both involved. The authorization sets out the rules of engagement: who may be targeted, which channels may be used, which pretexts are approved, which systems and objectives are in scope, the dates, how data will be handled and who to call if something goes wrong. Third-party systems, such as an outsourced help desk or a managed email service, need their own consent or are excluded.

Every exercise has a control group, sometimes called a white cell: a few trusted people at the client who know the exercise is running, can verify that an activity is part of it, and can stop it immediately. That group decides how to handle the moment when the security team or a manager discovers the test, so that real incidents are never confused with exercise activity.

When the scope includes vetting individuals

Some clients want background checks on staff in sensitive roles as part of a wider review of insider and social engineering risk. Delator leverages a locally licensed partner in its network to complete that work and does not do it itself. Exercise design and delivery stay with Delator's consultants.

03Phishing

Phishing and spear phishing simulations that measure the right things

Many phishing programmes measure only click rates, which encourages easy campaigns and tells leadership little. Delator's phishing simulations are built around what a real attacker would send to that organization: invoice notices for finance teams, document-sharing alerts for staff who collaborate externally, delivery notifications for operational sites, single sign-on prompts that mimic the client's own login page. Spear phishing campaigns target specific roles with messages built from public information about the organization.

The most useful metric is usually reporting, not clicking. A campaign where some staff click but many report the email within minutes, and the security team pulls the message from every inbox, shows a healthy organization. A campaign with few clicks but almost no reports shows staff who ignore threats rather than escalating them. Delator measures opens where technically meaningful, clicks, credential submissions, attachment interactions, report rates and time to first report, by department and country.

Modern phishing increasingly targets multi-factor authentication. Attackers use proxy-based phishing kits that relay a login in real time and capture session tokens, and they send repeated push prompts until someone approves one. Where the client authorizes it, Delator tests whether staff and technical controls stop these techniques. Any credentials captured during a test are handled under the rules of engagement: never used outside the agreed scope, stored securely and destroyed at the end.

• Campaigns tailored by role, region and language
• Credential capture pages hosted under controls agreed with the client
• Testing of multi-factor fatigue and session token theft where authorized
• Measurement of reporting speed and security team response
• Landing pages that explain the exercise and point staff to guidance

04Vishing

Vishing and authorized pretext calls to help desks, finance and reception

Phone-based social engineering, often called vishing, is effective because a confident caller can create urgency that email cannot. The help desk is the most common target: an attacker calls pretending to be an employee who is travelling, locked out and under pressure, and asks for a password reset or a new multi-factor device. If the help desk relies on information an attacker can find, such as an employee number printed on a badge or a manager's name from a professional networking site, the account can be taken over in minutes.

Delator's pretext calls test those verification processes under authorization. Every pretext is written down and approved by the client before calls begin. Calls target processes, such as help desk resets, supplier bank detail changes, payroll changes, executive assistant requests and reception enquiries, rather than trying to embarrass individuals. Testers stop and identify the exercise to the control group if a call goes somewhere unexpected, such as a member of staff becoming distressed.

Call recording raises legal questions that differ between countries and, in the United States, between states. Some places require the consent of every party to a recorded call. Delator agrees during scoping whether calls will be recorded, notes taken or neither, based on the law that applies to the caller and the person called. Where recording is not appropriate, testers keep contemporaneous written notes.

Processes commonly tested by phone

• Password and multi-factor resets at internal or outsourced help desks
• Changes to supplier bank details and payment instructions
• Payroll and direct deposit changes
• Requests to executive assistants for calendars, travel plans or documents
• Reception and switchboard disclosure of staff names, locations and schedules

05AI-enabled fraud

Testing defences against deepfake and AI-enabled social engineering

Generative AI has made convincing voice and video impersonation inexpensive. Attackers can clone a voice from a short public recording, generate fluent messages in any language and build fake profiles at scale. A widely reported case in Hong Kong in 2024 involved an employee of a multinational engineering firm who transferred around US$25 million after a video call in which the other participants, including someone presented as the chief financial officer, were deepfakes. The case changed how many boards think about payment verification.

The useful defence is not better human detection of deepfakes, which is unreliable, but processes that do not depend on recognizing a voice or a face. Payment approvals that require a call back to a known number, code words for high-risk requests, dual approval for changes to bank details, and a culture where staff are thanked for slowing down an urgent request from a senior executive all reduce risk regardless of how convincing the fake is.

Social engineering testing can check whether those processes hold. With explicit client authorization, and usually with the consent of the executive being imitated, Delator can test how finance, treasury and assistant teams handle urgent requests that appear to come from leadership. The rules of engagement set strict limits: which executives may be imitated, which channels may be used, what may be requested and the point at which testers must stop and reveal the exercise. No funds are ever actually moved.

• Executive consent before any imitation of their voice or likeness
• Tests stop before any payment or irreversible action
• Focus on callback, dual approval and code word controls
• Recommendations for payment and change-of-details procedures

06Other channels

Text messages, QR codes, removable media and in-person pretexts

Attackers use whatever channel staff trust. Text message phishing, sometimes called smishing, reaches staff on personal and corporate phones and often bypasses email filters entirely. QR codes in emails or on printed notices send users to credential pages that security tools cannot easily inspect. Collaboration platforms such as Microsoft Teams and Slack can carry messages from external accounts that look internal. Delator includes these channels where the client authorizes them and where the targets are corporate rather than personal accounts, unless the client has a lawful basis and policy covering personal devices.

Removable media tests, such as leaving marked USB devices in car parks or common areas, check whether staff plug unknown devices into corporate machines. Delator's test devices only report that they were connected; they do not run harmful code. In-person pretexts, such as posing as a courier, contractor or auditor, overlap with physical penetration testing and follow the same safety rules: an authorization letter carried at all times, no harm to people, no damage beyond agreed limits and compliance with local law.

Each channel is a separate line in the rules of engagement, with its own approved pretexts, targets and limits. That keeps exercises proportionate and makes the report easier to act on, because each finding is tied to a specific channel and control.

07Red team

Red team and adversary simulation engagements

A red team exercise starts from objectives, not from a list of systems. The client and Delator agree what a realistic adversary would want, such as access to the payments platform, exfiltration of a defined set of test data, control of a production environment or access to a named executive's mailbox, and the red team tries to achieve those objectives using any authorized route. Routes typically combine social engineering, exploitation of exposed systems, use of stolen credentials, lateral movement and, where included, physical entry.

Good red team work is guided by threat intelligence. Delator considers which kinds of attacker are relevant to the client's sector and regions, such as financially motivated groups, state-aligned espionage actors or insiders, and models their known tactics and techniques using MITRE ATT&CK. That keeps the exercise realistic and makes the results meaningful to the defenders, because they can see how the simulated adversary compares with the threats they actually face.

Regulated threat-led testing frameworks exist in several jurisdictions, including the European Central Bank's TIBER-EU framework, the Bank of England's CBEST and threat-led penetration testing under the EU's DORA regulation. These programmes have defined phases, regulator involvement and specific provider requirements. Delator explains during scoping which requirements apply and whether a planned exercise is a regulated test or a voluntary one. Voluntary red team exercises are often used to prepare for regulated tests.

Typical phases of a red team exercise

• Objective setting and threat modelling with the control group
• Reconnaissance of people, technology and premises from public sources
• Initial access through authorized social engineering, technical or physical routes
• Establishing a foothold and command and control within agreed limits
• Privilege escalation and movement toward objectives
• Objective completion using marked test data, never real exfiltration of sensitive data
• Reporting, replay with defenders and remediation planning

08Purple team

Purple team exercises with your security operations team

Red team exercises show whether an attack would succeed. Purple team exercises show defenders exactly how to stop it. In a purple team session, Delator's consultants and the client's security operations, detection engineering and incident response staff sit together, physically or virtually. The consultants run a technique, the defenders check whether their tools logged it, alerted on it and gave an analyst enough information to act, and together they adjust detection rules before moving to the next technique.

Purple teaming is efficient because every hour produces a concrete improvement. It is particularly useful after a red team exercise, to replay the techniques that went undetected, and for organizations that have invested in a security information and event management platform or endpoint detection tooling but are not sure how well it is tuned. Techniques are chosen from MITRE ATT&CK based on the threats relevant to the client, so coverage can be tracked and reported to leadership.

International organizations often run security operations from more than one region or through a managed provider. Purple team sessions can include each regional team and the provider, which helps align detection standards across the group and clarifies who is responsible for responding to what.

• Technique-by-technique testing with defenders watching
• Detection rule tuning during the session
• Coverage tracked against MITRE ATT&CK
• Inclusion of regional teams and managed security providers

09Ethics and law

Employee privacy, ethics and the law across countries

Social engineering testing involves deceiving employees, and that carries legal and ethical obligations. Under the EU General Data Protection Regulation and similar laws, the client needs a lawful basis for processing employee data collected during a test, such as who clicked a link or answered a call, and must handle that data proportionately. Delator designs exercises to collect the minimum data needed, agrees retention periods and supports the client's data protection officer with a description of the processing.

In several European countries, works councils or other employee representatives have rights to be informed or consulted about measures that monitor staff behaviour, and an employee-facing exercise may fall within those rights. Delator raises this during scoping so the client can involve its employment counsel and representatives early. Clients in other regions also have their own employment and privacy rules to consider, and the exercise is shaped to fit them.

Some pretexts are off limits regardless of the law. Delator does not impersonate police, emergency services, regulators or other government officials, does not use pretexts built around bereavement, health scares, layoffs or bonuses that could cause real distress, and does not target employees' family members or personal lives. Results are reported by process, department and country rather than by named individual, unless the client has a specific, lawful reason to request otherwise and the rules of engagement allow it.

• Data minimization and agreed retention for exercise data
• Support for data protection impact assessments where needed
• Works council or employee representative consultation flagged during scoping
• No impersonation of authorities and no distressing pretexts
• No targeting of family members or personal accounts

10Controls

Rules of engagement, stop conditions and deconfliction

A red team or social engineering exercise can look exactly like a real attack, so the rules for keeping it under control are written down before anything starts. The rules of engagement name the control group, the emergency contacts and the stop conditions. They define what happens if the security team detects the exercise: whether the defenders are allowed to respond fully, whether the control group intervenes, and how the red team is told to pause.

Deconfliction is the process of confirming whether a suspicious event is part of the exercise. Delator keeps a detailed log of every action, with timestamps, source addresses, accounts used and systems touched. If the client's team sees something alarming, the control group can check it against the log within minutes. That protects the client from treating a real intrusion as an exercise artefact, which is the most dangerous mistake in this kind of work.

Stop conditions are specific. They typically include any sign of a real attacker in the environment, any risk to safety or to the availability of critical systems, any employee distress, any contact with law enforcement, and any situation outside the approved scope. When a stop condition is met, testers pause, inform the control group and wait for a decision.

11Results

Measuring results and reporting to leadership

The output of social engineering testing is a picture of how the organization behaves under pressure, broken down so each team knows what to change. Campaign reports show metrics by channel, department and country, with examples of the messages and pretexts used. They describe which verification steps held and which were bypassed, and they recommend specific changes to processes, technology and training rather than generic awareness messages.

Red team reports tell a story: how the simulated adversary got in, what it did, which defences slowed it down, which alerts fired and who responded, and how close it came to each objective. Every action is mapped to MITRE ATT&CK and to the client's detection data. The report separates prevention failures, detection failures and response failures, because each needs a different fix. A replay session with the defenders walks through the timeline so they can see each step from the attacker's side.

Leadership summaries focus on business risk. They explain which objectives were reached, what that would have meant in a real attack, how the organization compares with its own previous results and what investment or process changes would make the biggest difference. Boards and audit committees often find this more useful than technical vulnerability counts.

• Channel-level metrics: clicks, submissions, reports and response times
• Attack narrative with timeline and ATT&CK mapping
• Prevention, detection and response gaps identified separately
• Process and control recommendations ranked by impact
• Replay and debrief sessions for defenders and leadership

12Preparation

How to prepare your organization for an exercise

Preparation decides whether an exercise produces clean, useful results or a week of confusion. The first step is choosing the control group: small enough to keep the exercise realistic, senior enough to make quick decisions, and available across the time zones in scope. It usually includes someone from security leadership, someone from legal or compliance and, for exercises involving finance or the help desk, a senior manager from those functions who can stop a process if a test goes further than intended.

Technical preparation follows. For phishing, the client decides whether test domains will be allow-listed in email filters, which measures how staff respond, or left to face the filters, which measures the technical controls as well. Both are valid, but they answer different questions and should not be mixed in one campaign. For red team work, the client confirms which security tools are in place, which managed providers need to be informed under their contracts, and which systems are too fragile or too sensitive to touch.

Finally, the organization should decide in advance how it will communicate after the exercise. Staff who took part, knowingly or not, should hear what happened, why it matters and what is changing, in a tone that thanks those who reported and supports those who did not. A short, well-handled message after social engineering testing does more for security culture than any amount of annual training.

• Name the control group and confirm 24-hour availability
• Decide whether test infrastructure is allow-listed or tested against filters
• Inform managed security and outsourced help desk providers where contracts require
• Identify fragile or excluded systems and people
• Draft the post-exercise message to staff before the exercise starts

13Programme

Building a social engineering testing programme over time

A single campaign gives a snapshot. A programme gives a trend. Many organizations run phishing simulations several times a year, targeted vishing tests of help desks and finance once or twice a year, and a red team exercise every year or two, followed by purple team sessions to close the gaps. Results are compared over time so leadership can see whether training, process changes and technology investments are working.

Programmes work better when they reward the right behaviour. Staff who report a suspicious email or call should receive a quick, positive acknowledgement, and the security team should share real examples of attacks they have stopped. Punishing people who click tends to suppress reporting, which is the opposite of what the organization needs. Delator helps clients design programmes that build a reporting culture rather than a fear of being tested.

For international organizations, a programme should reflect regional differences in language, working culture, threat activity and law, while keeping a common measurement framework so results can be compared across the group. Social engineering testing in one country may need a different pretext library and different employee consultation steps from the next, but the questions being answered are the same.

Step by step

How an Engagement Works

1. 01

   Objectives and scope

   Delator and the client agree what the exercise should answer, which channels and teams are in scope, and whether it is a campaign, a red team or a purple team engagement.

2. 02

   Legal and privacy review

   The client's counsel, data protection officer and, where needed, employee representatives are involved early, and Delator documents the data processing.

3. 03

   Signed authorization

   The organization signs the rules of engagement covering targets, pretexts, dates, stop conditions, data handling and the control group.

4. 04

   Pretext and scenario approval

   Every email, call script, message and in-person story is approved in writing before use.

5. 05

   Execution

   Delator's consultants run the exercise, logging every action and keeping the control group informed.

6. 06

   Deconfliction and stop handling

   Suspicious events are checked against the log, and testers pause whenever a stop condition is met.

7. 07

   Report and replay

   The client receives metrics, narrative and recommendations, followed by debriefs and, for red teams, a replay with defenders.

8. 08

   Programme follow-up

   Results feed into the next campaign or purple team session so improvements can be measured.

Deliverables

What You Receive

• Signed rules of engagement, approved pretext library and control group list
• Phishing, vishing and smishing campaign reports with metrics by channel, department and country
• Red team attack narrative with timeline, objectives reached and ATT&CK mapping
• Detection and response gap analysis for the security operations team
• Process recommendations for help desk, finance, payroll and executive support teams
• Leadership summary in plain English for boards and audit committees
• Purple team session notes and detection improvements
• Confirmation of exercise data destruction at the agreed point

Industries

Who Uses Social engineering/red team Services

• Financial servicesPayment fraud, account takeover and regulator expectations of threat-led testing make social engineering testing and red teaming a core control.
• Technology and SaaSHelp desk and administrator accounts give attackers access to customer environments, so verification processes need regular testing.
• Manufacturing and engineeringSupplier payment fraud and espionage against designs and processes often begin with a convincing email or call.
• HealthcareBusy, service-focused staff and sensitive patient data make phishing and pretext calls a persistent risk.
• Professional servicesFirms that handle client funds and confidential matters are frequent targets of impersonation and payment diversion.
• Retail and consumer brandsLarge distributed workforces and customer service teams create many entry points for social engineering.
• Energy and critical infrastructureState-aligned attackers target these sectors, and red team exercises help test detection of patient, well-resourced adversaries.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• Penetration testingInternational Penetration TestingDelator Global provides international penetration testing for companies whose systems, offices and data sit in more than one country.
• Penetration testingPhysical Penetration TestingDelator Global carries out physical penetration testing for organizations that need to know whether their buildings actually keep the wrong people out.
• CyberCyber InvestigationsCyber investigations establish what happened during a security incident or digital fraud, how the attacker got in, what they touched, and what evidence exists to support recovery, notification and legal action.
• ConsultingInternational Security ConsultingDelator Global provides international security consulting to general counsel, CFOs, CISOs and compliance leaders who need practical advice on risks that cross borders.
• CorporateInsider Threat InvestigationsInsider threat investigations examine what happens when someone with legitimate access, an employee, contractor, partner or former staff member, uses it to take data, steal trade secrets, commit fraud or cause harm.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries