Someone with the authority to grant it — normally a CISO, CTO or an executive who owns the systems in scope. We require the authorisation in writing, naming the targets, the exclusions and the stop conditions. See the authorization policy.

Not without their permission. Cloud providers, SaaS vendors and suppliers each have their own authorisation requirements, so they are either excluded or you obtain permission first and we confirm it in writing before starting.

We notify your named contact immediately, by the agreed channel, rather than saving it for the report. For critical findings affecting production safety we may pause testing until you have decided how to proceed.

We plan for it. Destructive tests are excluded by default, timing windows are agreed, and any technique carrying operational risk is discussed with you before it is used.

An authorised campaign against an agreed population, using voice, email, text and — where in scope — physical approaches. Results are captured per target, per pretext and per channel, against a baseline. See social engineering.

No, and we will not run a campaign designed to embarrass individuals. Reporting is aggregated by role and department, with individual results handled confidentially and used for targeted training rather than blame.

Under the data handling agreement signed before testing: minimum necessary collection, agreed retention, defined storage location, and deletion at the end of the engagement. See the privacy policy.

Yes — 24 hours a day, 7 days a week, 365 days a year. Our security analysts monitor your network and workstations for internal and external threats across that coverage.

Only to the extent you have agreed in advance. Containment authority is defined during onboarding — which actions analysts may take unilaterally, and which require a call. Whatever we agree, it is written down before monitoring starts.

Isolation and mitigation of a confirmed threat by the Emergency Response Team — containing the spread rather than completing the full investigation, which takes longer and is reported separately.

It goes to our internal R&D department to be reverse engineered and analysed. The holistic understanding of the threat and malware is what allows for infrastructure hardening and advanced threat detection. See security research.

We capture evidence in a forensically sound manner and document the chain of custody, and we can produce a report suitable for insurers or counsel. We are not a law firm and do not provide legal advice; where litigation is likely, tell us at the start so evidence handling is planned accordingly.

Ethical Social Engineering, Defensive Social Engineering and Advanced Persistent Threat. All are instructor-led and scenario-driven.

Yes. Any certification can be delivered privately, and we will tailor the scenarios to your environment and sector.

We teach the technique and the boundary together. Authorisation, scope, consent and data handling are assessed as part of the course, and participants who cannot work within them do not pass.