You can spend a fortune on firewalls, endpoint protection, and network segmentation, and an attacker can still walk past all of it with a confident phone call and a plausible story. Technology does not need to fail for a business to be breached. A person just needs to be helpful, busy, or trusting at the wrong moment, which happens to everyone eventually.

Why people remain the path of least resistance

Firewalls do not have deadlines to hit, do not want to seem unhelpful to someone claiming to be from IT, and do not get tired at four o’clock on a Friday. Staff do all three, which is exactly what social engineering exploits. A well-crafted phishing email, a phone call impersonating a supplier, or someone in a hi-vis vest walking confidently through reception can bypass every technical control a business has invested in, simply by targeting the one layer those controls were never designed to cover. No firewall rule stops a person from wanting to be helpful.

Testing this properly requires more than firing off a generic phishing template. A serious internal network pen testing engagement can include physical and social elements alongside the network testing, showing you exactly how far a convincing pretext would actually get someone inside your specific building with your specific staff, rather than a generic estimate borrowed from some industry average that means very little to you.

Small pieces of information add up to a convincing story

Attackers rarely need to guess. Job listings reveal what software you run internally. LinkedIn reveals who manages which team and when they started. An out-of-office reply reveals exactly who is away and who is covering for them. Piece these together and a caller claiming to be from your IT provider, asking a stressed employee to reset a password over the phone, sounds entirely legitimate because every detail they mention checks out, and checking out is usually all it takes to be believed without a second thought.

William described a recent test that unsettled the client’s leadership team more than any technical finding could have.

“I called reception pretending to be a new starter who’d forgotten their door code, using a name I’d pulled from a LinkedIn post congratulating someone on joining that week. I was inside the building within four minutes, and nobody asked to see any identification at all.”

— William Fieldhouse, Director of Aardwolf Security Ltd

Four minutes, one public LinkedIn post, and a confident tone were all it took. No malware, no exploit code, just a believable story delivered to someone whose job is to be welcoming rather than suspicious, exactly as their role requires them to be.

Train people the way you patch systems

Awareness training needs to be ongoing and specific to your business, not a once-a-year video nobody remembers by lunchtime. It works best when staff are shown real examples of what a pretext looks like from the inside, not abstract warnings about being careful, and when reporting a suspicious approach is treated as a genuine win rather than a mild embarrassment. Combine that training with regular testing from the best pen testing company pen testing company you can find, one that actually attempts these tactics rather than just discussing them in theory, and speak to Aardwolf Security about building a realistic picture of your human risk.