A social engineering test simulates techniques attackers use to deceive people, such as fake emails, messages, and calls, and measures how many employees disclose information or credentials. When conducted well, it also shows what an attacker could do with what was handed over.
An awareness campaign teaches. A security test measures the real impact of an acquired credential.
What the numbers show
The simulations in the 2026 Cyber Risk Landscape, a Vultus study, involved more than 80,000 email phishing attempts. For every 34 people who opened the message, 3 submitted a valid credential.
The rate may seem low to defenders. For attackers, it is enough, because a single credential lets them get started. In a company with a thousand employees, the question is how many people will hand over their credentials.
International data confirm the scale. ENISA identified phishing as the leading initial intrusion vector in Europe, accounting for around 60% of cases, and notes that AI-assisted campaigns already represented more than 80% of social engineering observed in early 2025. In the United States, phishing and spoofing topped the number of reports to the FBI in 2025, with 191,561 reports.
Why the list of people who clicked tells you little
Many campaigns end with a list of people who clicked and an uncomfortable conversation with them. The result is employees afraid to report mistakes and the impression that the problem is an individual one.
If credentials grant access to email, the cloud, and the network without a second factor, the risk lies in a single click being enough. The more useful question is how far obtained credentials would take an attacker.
How a good test works
In the Vultus methodology, a campaign includes planning, creating materials tailored to the company, execution with a consolidated view of who opened, clicked, and submitted credentials, and a focused attack: a quick, controlled test of what the obtained credentials can access. This is followed by consolidation, executive and technical reports, and employee training. The full cycle takes about four weeks.
Social engineering also spans multiple channels. A call from someone claiming to be IT support, followed by a message with a link to validate access, tends to be more successful than an isolated email. AI-manipulated content increases this risk, as shown in the article What is a deepfake.
Fictional example: the intern's credentials
A logistics company runs a campaign about a benefits update, and twelve people submit their credentials. Leadership's first instinct is to strengthen training for operational roles.
In the focused attack, a finance intern's credentials unlock email, which lacks a second factor. The inbox contains a spreadsheet of banking portal passwords shared by the team. Fixes include a second factor for email, a password vault for finance, and an access review, followed by training for everyone.
How to measure progress
Indicators that show improvement:
- Credential submission: more relevant than the click rate.
- Reporting rate: how many people notified security.
- Time to first report: the earlier it arrives, the sooner security can act.
- Credential reach: what the targeted attack was able to access.
Periodic campaigns with varied themes work better than one large annual effort. With clear rules, a protective objective, themes that do not exploit sensitive personal situations, and results handled in aggregate, the test preserves employees' trust.
Social engineering with a focused attack
Vultus conducts multichannel social engineering tests and measures the reach of obtained credentials, connecting results to technical and process fixes. Explore Vultus social engineering testing and read about identity and access management.
