We attack.Without ever being on site.
The remote pentest shows how vulnerable your organisation really is to attacks from a distance.
How vulnerable is your organisation to attacks from a distance?
Firewalls, spam filters and MFA are not enough. Only a realistic remote pentest shows whether your safeguards withstand a targeted attack.
Typical weaknesses we uncover
User accounts easily obtained through phishing, spear phishing and vishing
Existing measures that are no match for social engineering attacks
No realistic assessment of the external attack surface
Theoretical risk assessments instead of a reliable basis for decisions
Simulate realistic attacks from a distance
The remote pentest reproduces real attack scenarios in which attackers operate without physical access. The focus is on social engineering techniques that work through publicly available information, digital communication and human behaviour.
Identify security gaps
In the remote pentest we test whether and how attackers can manipulate employees remotely, obtain credentials, undermine multi-factor authentication and compromise user accounts.
Understand the real impact of attacks
The test makes visible what impact successful remote attacks can have, for instance through compromised accounts, bypassed multi-factor authentication or preparatory access for further attacks.
Reliable findings instead of assumptions
The remote pentest delivers an objective assessment of the actual attack surface. You gain clear insight into how effective existing safeguards are and where action is needed first.
Our approach to the remote pentest
Pre-engagement
At the start we jointly define the objectives, scope, legal framework and escalation rules. This ensures the test is carried out in a controlled, traceable and legally sound manner.
- Scope definition and objectives
- Legal safeguards and contract
- Escalation paths and emergency contacts
Reconnaissance
Preparation is based on comprehensive OSINT analysis. We examine publicly available information, organisational structures, role profiles and data leaks in order to develop realistic attack scenarios and pretexts.
- OSINT analysis of structures and role profiles
- Examination of data leaks and public information
- Development of realistic attack scenarios
Attack simulation & escalation
The attack simulation combines several social engineering vectors in a black-box approach. We use targeted vishing attacks as well as phishing, spear phishing and smishing campaigns. The aim is to test whether and how credentials can be obtained, 2FA processes bypassed through social engineering and user accounts taken over.
- Multi-vector attacks: vishing, phishing, spear phishing, smishing
- Testing of 2FA bypass and account takeover
- Complete documentation of all attack paths
Documentation & management workshop
After the remote pentest you receive a detailed, anonymised report with a structured analysis of the attack paths, an assessment of the identified weaknesses and concrete, prioritised recommendations. In addition, we hold a short online workshop for security officers in which the results are put into context, risks are explained and possible next steps are discussed.
- Detailed, anonymised report with risk classification
- Structured analysis of all attack paths
- Online workshop with concrete, prioritised measures
[...] We were surprised how quickly you were able to harvest credentials from our team. Actual access to our systems was prevented by the MFA we had implemented. However, bypassing MFA was not within our scope for legal reasons. [...]
We were very satisfied with the engagement of Human Risk Consulting GmbH and the open and fast communication with Mr Willer. We look forward to the next joint projects.
I was nervous for two weeks in the run-up to this pentest. [...] Thanks to the close exchange I felt as if I were live on the pentest myself. [...] Thank you for the good cooperation!
Robust protection for your corporate security
Frequently asked questions
How does a remote pentest differ from a classic IT pentest?
Our remote pentest focuses on the human factor. Instead of looking for technical vulnerabilities in systems, we combine social engineering techniques such as vishing, phishing, spear phishing and smishing to test how attackers can gain access to user accounts and systems from a distance.
Which attack methods are used?
The test combines several vectors in a black-box approach: targeted vishing attacks, phishing and spear phishing campaigns, and smishing. The aim is a realistic simulation of external attacks as they actually happen.
How are the results presented?
You receive a detailed, anonymised report with a structured analysis of all attack paths, an assessment of the weaknesses and concrete, prioritised recommendations. In addition, we hold an online workshop for security officers.
How long does a remote pentest take?
Depending on the scope and number of attack vectors, between 5 and 15 days. The OSINT phase and pre-engagement come on top of that. The exact duration is agreed together during pre-engagement.
Ready to put your security to the test?
A first conversation: no obligation, confidential, and as equals. Together we work out where your biggest risks lie.