Two quotes, one label
The head of IT has two quotes on the desk, both with the same heading. Both social engineering testing vendors call their service a "social engineering pentest." Only one of them actually checks whether the company can be breached.
Quote A is lean. Three working days to deliver, 400 recipients, one phishing template from the library, a landing page with a form, and at the end a PDF with click and submission rates per department. The price is easy to budget, and the client barely has to lift a finger. Procurement loves it.
Quote B looks unwieldy next to it. Three weeks of lead time just for reconnaissance, then custom pretexts, a call to the internal help desk aimed at getting a password reset, and optionally an attempt to get into the building on a visitor badge. On top of that comes an authorization document listing every target person, channel and abort criterion individually. Both quotes are made up for this article, but anyone who has ever laid three bids side by side will recognize the setup.
The difference isn't a matter of taste. Quote A measures how well your mail filter and your staff spot a generic email. Quote B measures whether a motivated attacker can reach privileged access through phone calls, pretexts and gaps in your processes. Those are two completely different questions, and only one of them tells you how real your risk is.
If all you buy is click rates, you're testing your mail filter. Attacks that use the combination of pretexting and phishing don't stay in the inbox. They also happen on the phone.
Why "social engineering pentest" doesn't guarantee any particular scope
The term is used in two ways on the market. Specialist firms focus solely on phishing, vishing and physical pretexting, while full-service offensive security firms combine the human attack surface with technical attack paths. In between are platform vendors whose actual product is awareness software, which they call a "pentest" anyway.
A complete social engineering test combines several vectors in one coordinated campaign: email, phone, pretexting and physical intrusion. The process behind it is repeatable. According to Cyphere, it consists of scoping and authorization, OSINT research, pretext development, controlled execution, evidence collection and analysis. If one of these steps is missing from the quote, it will be missing from the project.
How to judge quality in the first place
Three reference frameworks can help you choose. Germany's Federal Office for Information Security (BSI) certifies IT security providers in the IS penetration testing scope, with the stated aim of helping organizations select a provider. Internationally, CREST plays a similar role and requires accredited organizations to show that their testers have been individually assessed. For regulated industries, TIBER-EU provides its own guidance on procuring threat intelligence and red team providers.
| Framework | What it assesses | How you can check it |
|---|---|---|
| BSI IS penetration testing | Reliability, independence, expertise and quality of the provider | Ask for the scope |
| CREST Member Company | The organization's processes, data handling and standards | Public register |
| CREST Accredited Company | Technical delivery quality as well | Public register |
| TIBER-EU | Selecting and engaging red team testers | Regulated sectors only |
You can standardize the method, not the test
The BSI states plainly that penetration tests have to be tailored to the situation of the organization being tested and can only be standardized to a limited extent. That makes a good litmus test for any quote. If the statement of work for a municipal utility's IT looks exactly like the one for a private hospital, you're looking at a product, not a test.
Click rates measure the wrong thing, and real incidents show why
Awareness campaigns work. Nobody disputes that. The benchmarking report from KnowBe4 shows the global click rate dropping by 86% after twelve months of training. But that number tells you nothing about what happens when someone calls the service desk at 10:40 p.m., knows the names of two team leads, and needs a new password because he's supposedly on a business trip.
Same pattern, different industry. On July 15, 2020, attackers went after Twitter employees with targeted phone spear phishing, targeted 130 accounts and downloaded the full data for seven of them. At Uber in 2022, an attacker spammed a contractor with MFA push requests for over an hour and contacted them directly, posing as the IT department, until the contractor approved one. A mass phishing simulation would not have predicted any of these three incidents.
A low click rate doesn't prove your organization is resilient. It proves that one particular email on one particular day fooled few people.
Five questions every quote has to answer before you sign
To sort the serious offers from the rest, you need five questions and the willingness to treat an evasive answer as an answer. You don't need to know the methodology.
Procurement checklist for your next social engineering engagement
These points belong in your request for proposal, not in the contract negotiations. They take you half an hour and spare you a project whose results nobody needs.
- Demand a scope document: target groups, OSINT sources, planned pretexts and the number of vishing calls, in writing, before you accept the quote.
- Verify the accreditation: ask for the scope and check it yourself.
- Sign a separate authorization: a general pentest engagement doesn't automatically cover social engineering. It needs an explicit authorization with clear limits.
- Put the help desk in scope: support staff can reset passwords and confirm MFA, and that is exactly what made the attack on MGM Resorts possible. A social engineering assessment without the phone channel leaves the most important door untested.
- Fix the report depth in the contract: process analysis, a chain of evidence and a retest instead of just a rate. Ask for an anonymized sample report up front.
- Factor in regulation: under NIS2, measures at essential entities should also address physical security and human error, and the test report has to be able to show that.
Both formats have their place. Use the simulation to track trends over months, and the assessment to find out whether a real attacker could get in today. Just don't mix up the results.
Questions clients ask before commissioning a test
What does a social engineering test cost, and why do quotes vary so much?
The price range comes almost entirely from the research phase and the number of channels. An automated email simulation is a matter of running software. An OSINT-driven test with custom pretexts, vishing and evidence collection is project work spanning several weeks.
Is a phishing simulation enough to demonstrate NIS2 compliance?
Under § 30 BSIG, entities must take appropriate, proportionate and effective risk management measures, which according to the BSI should also include physical security and protection against human error. A click-rate statistic alone doesn't show that organizational safeguards, such as identity checks at the help desk, actually work. For that you need a documented review of the processes involved.
Does a social engineering test need its own legal authorization?
Yes. Methods such as social engineering or phishing simulations require an explicit, separate authorization from the client and are not automatically covered by a general pentest engagement. Only the person with authority over the affected data can give consent, and it applies only to the scope specifically agreed. Bring in the works council and the data protection officer early.
How can I tell whether a vendor is really certified?
Accreditations always apply to defined scopes, never to a company as a whole. The BSI certifies providers in areas including IS penetration testing, and CREST distinguishes between Member Company and the higher tier, Accredited Company. Check the claim in the relevant public register, not on the vendor's website.
Don't buy the campaign, buy the answer to your risk question
What counts is what you want to know at the end. Price comes second. If you want to know whether your staff improve over twelve months, a simulation platform is the right tool, according to KnowBe4. If you want to know whether someone could take over an admin account through your service desk tonight, you need reconnaissance, pretexts and a person on the phone.
In the 2024 to 2026 editions of the DBIR, social engineering accounted for 17 to 22% of all breaches. That belongs in the same reporting line as an infrastructure pentest, not as a footnote in the annual awareness report. Procurement should reflect that, with a scope document, verified accreditation and a report your auditors can read. If one of these is missing from the quote, it will be missing from the project.
- The question first, then the format: trend measurement and attack simulation are two different products, not two price points to compare.
- Phone and help desk belong in scope: the MGM attack came through a voice call, not the inbox.
- Authorization before kickoff: in writing, clearly bounded, signed by the person with authority.
- 10 minutes for 100 million: The Psychology Behind The MGM Help Desk Call in Detail
- Red team, pentest, purple team: What The Difference Is and When You Need Which
- Deepfake-Vishing: How AI Voice Clones Are Taking Vishing Attacks to a Whole New Level
Which of the two quotes is on your desk right now?
We'll go through scope, vectors and report depth with you and show you what a social engineering test tailored to your organization can actually tell you.
Book an initial call →
