Phone Phishing Assessment: Determining Alertness – Raising Employees’ Awareness

With targeted calls to individual employees under false pretenses, we attempt to achieve certain goals agreed on in advance with the customer. Possible goals are:

• Finding out passwords or properties of passwords (length, complexity)
• Uncovering non-public details about the company (e.g. actual IT security measures)
• Executing malicious code (in reality, for instance, ransomware)

No mistakes made by particular individuals are revealed. In fact, SySS will carry out the attack in the most anonymized way possible and provide results in the form of a quantitative, statistical evaluation of the attack outcome. The results are anonymized and documented in a management-ready report.

From a phone phishing assessment, you can expect the following results:

• Statistics relating to the current awareness of employees
• Enhanced awareness of employees
• Verification of processes

Phone phishing assessments are carried out in the course of one or two weeks and usually involve the following project phases:

• Kickoff
• Registration of domains
• Design of a supporting phishing website
• Review phase
• Calling individual employees
• Evaluation of the results
• Documentation