Test whether trust can be turned into access.
Most attacks still need someone to say yes. FLODISQ examines where that yes comes too easily: at the front door, in the inbox, in chat, on the phone and in supplier contact. We combine controlled exercises across several channels with technical security testing and practical training, so you see the full chain from first contact to actual access.
Pause. Verify. Report.
The attacker does not fight the procedure. They use it.
Organisations invest in technology, access controls and written procedures. Yet trust still moves through the organisation every day: at reception desks, over the telephone, in email and messaging, through suppliers and in conversations between colleagues.
A convincing pretext can make an unusual request appear routine. AI makes this easier to scale by helping attackers reproduce voices, faces, writing styles and personal context. The decisive control is therefore not suspicion. It is consistent verification.
FLODISQ shows where a good story still beats a good control, and gives employees a simple routine for the moments that matter.
- Firewall
- MFA
- Endpoint protection
- Access control
- Email filtering
- Written procedures
- Reception
- Telephone
- Email & messaging
- Suppliers
- Colleagues
Social engineering across channels
Phishing and targeted email
Controlled email scenarios that test recognition, verification, reporting and the handling of links, attachments or requests.
Telephone and voice scenarios
Calls from someone who seems to belong: a manager, a partner or a contractor. Usually one part of a wider scenario rather than a stand-alone test.
Physical access and reception
Tests of visitor handling, identity checks, tailgating, deliveries, contractor access and escalation at physical locations.
Messaging and collaboration
Realistic scenarios through SMS or approved collaboration channels, including requests that appear to come from a colleague or manager.
Supplier and third-party pretexts
Scenarios built around credible external parties, changed payment details, support requests or business relationships.
Public information exposure
Analysis of how public profiles, posts, calendars and organisational information can be combined into a convincing pretext.
Every scenario is agreed in advance, proportionate to the risk and designed with clear ethical and operational boundaries.
Recognising someone is not the same as confirming them.
Generative AI makes it cheap to copy the cues people use to recognise each other. The answer is a simple habit, not suspicion: confirm unusual requests through a route you choose yourself, never the one you are offered.
A caller who sounds like someone you speak to every week.
A video meeting or profile that shows a familiar face.
A message with the same phrasing, sign-off and inside knowledge as a colleague.
Confirm through a number from your own address book, a colleague you know or a channel you start yourself.
Five ways trust is commonly misused
Conflict and emotional reversal
The target is pressured, blamed or pulled into an argument when they ask questions.
DefenceStay with the facts and never allow emotion to replace verification.
Urgency and emotional pressure
The attacker creates a problem that feels immediate and personal.
DefenceSlow the decision down: “I am happy to help, but I need to verify this first.”
Unverifiable identity
The profile, person or organisation cannot be independently confirmed.
DefenceCheck the person, organisation and communication channel using trusted information.
Pretexting
A plausible role, known supplier or familiar process lowers the threshold.
DefenceRemember that a credible story is not security confirmation.
Fragmented signals
Different employees receive different versions of the same operation.
DefenceReport unusual interactions so individual signals can be connected.
Five steps from first exercise to lasting habit
- 01
Map
We look at your organisation the way an outsider would: what is public, which decisions carry the most value and where requests from outside reach employees.
- 02
Build
We turn those insights into scenarios that may combine several channels, for example an email followed by a visit. Boundaries, timing and stop rules are fixed in writing.
- 03
Execute
The exercise runs under supervision and without damage. We record what goes right as well as what goes wrong: who checks, who escalates and who reports.
- 04
Debrief
We show employees how the scenario was put together and which moment offered a chance to stop it, then practise the response with them.
- 05
Strengthen
Management receives the findings and a prioritised plan for people, procedures and technology. A later exercise shows whether the improvements hold.
Measured by what goes right
Click rates say little about resilience. We look at whether employees pause, verify and report, and whether the procedures behind them actually support that behaviour.
Because FLODISQ also performs technical testing, we can show where a human weakness and a technical weakness reinforce each other.
- Scenarios are built around your sector, your locations and your actual processes.
- Several channels can be combined in one exercise, just as a real attacker would.
- Findings can be linked to penetration testing results for a complete picture.
- Positive behaviour such as reporting and escalating is recorded and acknowledged.
- Improvements cover training as well as procedures, contact details and systems.
Choose the engagement that fits your objective
Social engineering with clear scope and safeguards
Choose an engagement based on the channels, target groups, locations and realism required. Every exercise is scoped in advance because a single phishing scenario is very different from a multi-channel campaign involving voice, suppliers or physical access.
Final pricing is confirmed after a short design call covering objectives, channels, participant population, locations, scenario complexity, reporting and governance.
Exposure Review
For organisations that want to understand where social engineering is most likely to work before running a simulation.
- Review of high-risk roles and processes
- Publicly available information and pretext opportunities
- Key channels: email, voice, messaging, reception and suppliers
- Review of verification and escalation procedures
- Management findings and prioritised recommendations
- One specialist debrief
Focused Simulation
For a controlled exercise using one primary channel and a clearly defined target population.
- 1 primary channel: phishing, vishing, messaging or physical access
- Typically up to 100 participants or one defined team/location
- 1–2 scenario variants
- Standard pretext development
- Agreed rules of engagement and stop conditions
- Management summary and behavioural findings
- Practical debrief and improvement actions
Advanced Multi-Channel Simulation
For organisations that want to test how trust moves across multiple channels, roles or business processes.
- Typically 2–3 channels
- Up to approximately 300 participants or several target groups
- Multiple roles, teams or business processes
- More tailored pretexts using agreed organisational context
- Supplier, helpdesk or executive impersonation scenarios where appropriate
- Cross-channel correlation of behaviour and reporting
- Management + specialist debrief
- Prioritised people and process improvement plan
Complex / Physical Social Engineering
For higher-risk exercises involving physical access, multiple sites, complex pretexts or coordinated campaigns.
- Physical access or reception testing and/or 3+ channels
- Multiple locations, target groups or phases
- Tailgating, visitor, contractor or delivery scenarios where authorised
- Complex pretext development and reconnaissance
- Dedicated exercise coordination and escalation contact
- Detailed evidence and cross-scenario analysis
- Management + operational debrief
- Follow-up recommendations and optional retest
For recurring, multi-country or organisation-wide programmes combining assessment, simulations, training and improvement.
Request a price- Multiple campaigns through the year
- Multiple countries, entities or locations
- Role-based scenarios for high-risk populations
- Awareness sessions and targeted learning
- Baseline and follow-up measurement
- Governance, privacy and local consultation support
- Consolidated management reporting
- Custom cadence and retesting
For organisations that want social engineering to become a measurable improvement programme rather than a once-a-year test.
Build a programme- Annual baseline and risk review
- Quarterly or agreed campaign cadence
- Targeted learning after relevant exercises
- Trend reporting on verification, reporting and process adherence
- Periodic FLODISQ service review
- Campaign costs agreed in advance based on scope
All prices are indicative and exclude VAT. Participant numbers are practical starting points, not fixed limits: physical access, bespoke impersonation and governance requirements can change the package regardless of headcount. FLODISQ confirms the objective, legal and ethical boundaries, target population and scenario design, then provides a fixed engagement fee.
Price the engagement, not the number of phishing emails.
Price is driven by the effort needed to design, govern and execute a credible exercise safely. The number of emails alone is not a useful pricing measure.
| Criterion | Exposure | Focused | Advanced | Complex | Enterprise |
|---|---|---|---|---|---|
| Primary purpose | Assess exposure | Test one channel | Test multiple channels | High-risk / physical | Ongoing programme |
| Channels | Review | 1 | 2–3 | 3+ / physical | Custom |
| Population | Selected roles | ~100 | ~300 | Custom | Organisation-wide |
| Locations | Review | 1 | 1–2 | Multiple | Multi-site / country |
| Scenario | Risk review | Standard tailored | Bespoke | Complex / coordinated | Role-based portfolio |
| Price | From €2,950 | From €4,950 | From €8,950 | From €14,950 | On request |
Channels
One channel can normally fit Focused. Two or three channels usually moves to Advanced. Physical access or coordinated channel switching usually requires Complex scoping.
Participant population
Up to about 100 participants is a practical Focused starting point. Larger groups increase preparation, monitoring, evidence handling and reporting effort.
Target groups
One homogeneous group is simpler. Finance, HR, executives, service desk, reception and procurement often require different scenarios and safeguards.
Scenario complexity
Generic but realistic scenarios are lower effort. Bespoke supplier, executive, payment, account-recovery or operational pretexts require more design and validation.
Physical locations
Each additional site adds coordination, access rules, safety constraints and local escalation requirements.
Reconnaissance
Use of public organisational information can be standard. Deeper OSINT, supplier mapping or role-specific research increases preparation effort.
Governance and privacy
Works council, employee monitoring, legal, privacy, HR or cross-border requirements can materially affect design and lead time.
Reporting and debrief
A standard management summary is included. Board reporting, team-level workshops, individual coaching or multiple debriefs increase scope.
Follow-up testing
A repeat campaign or retest is priced separately unless included in an annual programme.
What is included in every simulation
- Scoping and legitimate testing objective
- Rules of engagement, exclusions and stop conditions
- Scenario and pretext design
- Controlled execution
- Evidence collection at the agreed level
- Management overview
- FLODISQ specialist debrief
- Prioritised improvement recommendations
What can change the price
- Additional channels, locations or target groups added after scoping
- Physical access testing, travel or on-site coordination
- Custom voice, video or AI-enabled impersonation scenarios
- Deeper OSINT or scenario-specific reconnaissance
- Cross-border privacy, HR, legal or works council requirements
- Additional workshops, individual coaching or board reporting
- Rush delivery or out-of-hours exercise windows
- Repeat campaigns or additional retests
When to use FLODISQ Social Engineering
Before a major change
Prepare employees for a corporate transaction, new supplier, office move, new helpdesk model or technology rollout.
After an incident or near miss
Understand how trust, process and communication contributed, then practise a safer response.
For high-risk roles
Test and train reception, finance, HR, executive support, IT service desks, procurement and privileged users.
For assurance and governance
Provide management with evidence about behaviour, reporting routes and the practical operation of controls.
To strengthen supplier processes
Test requests involving invoices, bank details, access, support and changes initiated by external parties.
To make awareness practical
Replace generic annual training with realistic situations, recognisable language and observable behaviour.
What you receive
Scenario and rules of engagement
A documented scope covering targets, channels, exclusions, safeguards, escalation and stop conditions.
Management overview
A clear view of the tested risk, observed control performance and the issues requiring management attention.
Behavioural findings
Patterns in verification, escalation, reporting and adherence to agreed procedures, presented at an appropriate level.
Process findings
Weaknesses in procedures, contact data, visitor handling, approval paths, reporting routes or system design.
Practical debrief
An engaging explanation of the techniques used, warning signals and safer responses.
Improvement plan
Prioritised actions for people, processes and technology, with options for follow-up measurement.
A response employees can remember
- Stop
Do not let urgency determine your pace.
- Record
Capture the request, identity, number and relevant details.
- Check
Use a trusted source or known colleague to verify independently.
- Call back
Return through a number or channel from your own records.
“I am happy to help, but I need to verify this first.”
Controlled, lawful and proportionate
Social engineering tests involve people and must be governed accordingly. Before launch, FLODISQ agrees the legitimate objective, authorised population, allowed channels, exclusions, personal-data handling, communications, escalation route and stop conditions.
We avoid scenarios that exploit sensitive personal circumstances or create unnecessary distress. Results should support learning and control improvement, not public ranking or individual blame. Where employee monitoring, works council consultation or local employment requirements are relevant, these are addressed before testing.
- Legitimate objective and authorised population
- Allowed channels and explicit exclusions
- Personal-data handling and communications
- Escalation route and stop conditions
- Works council, privacy and local employment requirements
Frequently asked questions
Is this just phishing?
No. Phishing can be included, but social engineering also covers telephone calls, messaging, physical access, supplier pretexts, public information and process manipulation.
Will employees know they are being tested?
That depends on the objective and agreed design. Some exercises are unannounced, while others use informed participation or controlled role play. Governance is agreed before launch.
Do you report individual names?
Not by default. We report on teams, roles and processes. Reporting on named individuals only happens with a clear purpose and agreements on privacy and employment law.
Can you test reception and physical access?
Yes. Scenarios can address visitors, deliveries, contractors, tailgating and identity checks, subject to site permission and agreed safety boundaries.
Can AI-enabled impersonation be included?
Yes, if it is legally permitted and you explicitly approve it. We then show how imitated voices, images or writing make a scenario more convincing, without causing unnecessary harm to the people involved.
What happens after the test?
FLODISQ provides a practical debrief and improvement plan. Follow-up exercises can then test whether verification, reporting and procedures have improved. For ongoing training, see Awareness & Training.
Would a believable story defeat your controls?
Tell us which people, processes or locations matter most. We will help design a controlled assessment and translate the results into stronger verification, reporting and decision-making.