Expert service
Attackers phish people, not firewalls.
We run the same phishing, phone and pretext attacks real adversaries use, measure who clicks, reports or hands over credentials, and train your team on what we found.
Why teams book this test
- People are the way in.Most attacks start with an email or a call. Measure how your team responds.
- Training needs a baseline.See who clicks and who reports, then train for what we found.
- An audit is coming.Reports your ISO 27001 or SOC 2 auditor can use as evidence.
What we test
- Phishing email campaigns tailored to your business
- Credential harvesting simulations, with consent
- Vishing and phone pretexting
- Help desk and password reset abuse
- Reporting culture: who spots and reports the attack
- Security awareness training after the exercise
How an engagement runs
- ScopeTargets, scenarios and approvals.
- RunCampaigns in the agreed window.
- MeasureWho opened, clicked and reported.
- ReportResults by team, with next steps.
- TrainAn awareness session on what we found.
Repeat each year, and compare the results.
Why experts
What you receive
Real people run the exercise, measure how your team responds and sign the report as an independent third party.
- Results by team: who opened, clicked, submitted or reported
- Every scenario we ran, with what people saw
- An independent third-party report. Reports your ISO 27001 or SOC 2 auditor can use as evidence.
- An awareness session on what we found
- A walkthrough call with your team
The usual exercise, minus the usual pain.
Typical provider
- PriceDay rates that grow with the job
- ScenariosGeneric phishing templates
- ResultsA click rate and nothing else
- HandoverA PDF in your inbox
- Next timeStart again from zero
Cerberon experts
- PriceA fixed quote after a 30-minute call
- ScenariosCampaigns written for your business
- ResultsWho opened, clicked, submitted and reported, by team
- HandoverAn awareness session on what we found
- Next timeResults compared with your last campaign
Questions about this service
Do you need HR or legal approval first?
Yes. We agree scenarios, targets and named contacts in writing before anything is sent, and we never collect real passwords or personal data beyond what the agreed exercise needs.
Do you name the people who clicked?
Only if you ask us to. Most clients prefer results by team, followed by training for everyone.
Tell us what you need tested.
A 30-minute scoping call, then a fixed quote.