Your team gets a call.Who hangs up?
Have your telephone attack surface tested realistically. Get an unvarnished assessment of your vishing risks.
Does your organisation withstand attacks over the phone?
Technical safeguards alone are not enough. Only a realistic vishing test shows whether your people and processes hold up when it counts.
Typical weaknesses we uncover
Unrecognised weaknesses in handling phone calls and a lack of verification
Employees follow phishing links, disclose credentials or bypass 2FA
Social engineering risks and missing compliance policies for phone contacts
Inability to recognise vishing attacks and respond correctly
Realistic tests that expose weaknesses
Attacks over the phone are among the most effective social engineering methods. Our vishing pentests simulate real attacks under controlled conditions and show how attackers manipulate employees, deliver phishing links and undermine two-factor authentication.
Identify security gaps
We test whether and how employees can be led by targeted phone attacks to open phishing links, enter credentials on prepared websites, disclose security-critical information or unknowingly bypass existing safeguards. We do not analyse individual misconduct but structural weaknesses in processes, communication and security awareness.
Assess security risks realistically
Our tests show how high the actual risk of successful vishing attacks in your organisation is, beyond theoretical assumptions or training completion rates. You receive a well-founded assessment of the possible impact, from account takeovers and initial access to internal systems, through the preparation of further attacks, to reputational and compliance risks.
Create a basis for decisions
The vishing pentest delivers reliable findings on how effective existing awareness and protective measures really are, where concrete action is needed and which next steps make sense and should be prioritised. The test has no training character and does not distort the results.
Our approach to vishing penetration tests
Pre-engagement
A vishing pentest starts with a clear framework. In pre-engagement we jointly define the objectives, scope, legal approvals and escalation rules. This ensures the test is carried out in a controlled, traceable and legally sound manner.
- Scope definition and objectives
- Legal safeguards and contract
- Escalation paths and emergency contacts
Reconnaissance
Before the actual attack we analyse publicly available information, typical communication patterns and relevant contexts of your organisation. On this basis we carry out OSINT analysis of structures, roles and procedures, develop realistic pretexts and prepare the required phishing infrastructure and suitable attack scenarios.
- OSINT analysis of structures and roles
- Analysis of communication patterns
- Development of realistic pretexts and vishing/phishing infrastructure
Attack simulation & escalation
During the attack simulation our social engineering specialists make targeted vishing calls under realistic conditions. The aim is to test whether and how employees can be manipulated over the phone to visit prepared phishing websites, disclose credentials or bypass existing two-factor authentication.
- Targeted vishing calls under real conditions
- Testing of data entry
- Complete documentation of all attack paths
Documentation & management workshop
After the test you receive a detailed, anonymised report with a structured analysis of the attack paths, an assessment of the identified weaknesses and concrete, prioritised recommendations. In addition, we hold a short online workshop for security officers in which the results are put into context, risks and causes are explained and possible next steps are discussed.
- Detailed, anonymised report with risk classification
- Structured analysis of all attack paths
- Online workshop with concrete, prioritised measures
I have run the service desk for eleven years. When someone tells me their team fell for a vishing attack, my first reaction is: “Sure, but not ours.” We were taught otherwise, but took it in good spirit. [...] In the three days afterwards I learned more about my own process than in the last two years of training. [...]
My SOC runs with 14 analysts in three shifts. We filter 18,000 events a day. During the vishing pentest we caught exactly zero of them. Not because we are bad, but because voice-only attacks were simply not on our radar. [...] We have built two new detection use cases since.
We have been working with Human Risk Consulting for 4 years and can warmly recommend working with Mr Willer.
Robust protection for your corporate security
Frequently asked questions
How does a vishing pentest work?
After pre-engagement and reconnaissance, our specialists make targeted vishing calls under realistic conditions. Everything is documented anonymously and presented in a workshop with concrete measures.
Is a vishing pentest legal?
Yes. Every test is contractually secured with clear rules, escalation paths and emergency contacts. We work exclusively within the agreed scope and comply with all data protection requirements.
Will employees know about the test?
Usually not; that is part of the test. Afterwards we recommend transparent communication that focuses on awareness rather than exposure. The analysis is fully anonymised.
What happens if an employee falls for the attack?
That is not an individual failure; it reveals structural weaknesses. We document the attack path anonymously and derive concrete improvements for processes, technology and awareness from it.
Ready to put your security to the test?
A first conversation: no obligation, confidential, and as equals. Together we work out where your biggest risks lie.