We are conducting a penetration test. Who specializes in social engineering tests?

If you mean authorized social-engineering penetration tests—phishing, vishing, smishing, pretexting, or physical-access testing—look for a penetration-testing/red-team firm that explicitly lists social engineering as a service.

Some firms worth evaluating:

• OnSecurity — offers CREST-accredited social-engineering penetration testing with manual testing.
• Pen Test Partners — CREST-listed and offers physical penetration testing and social-engineering audits.
• White Knight Labs — conducts phishing, vishing, and on-site social-engineering assessments.
• Redbot Security — specializes in human-led phishing, vishing, identity-verification, and physical-security testing.
• Artifice Security — provides electronic and physical social-engineering assessments, including phishing, vishing, and on-site intrusion testing.
• Prescient Security / Cacilian Testing Services — listed in the CREST marketplace with social engineering and red/purple/blue-team capabilities.

For a serious penetration test, I'd prioritize a provider with independent accreditation (such as CREST), experienced human testers, clearly defined rules of engagement, and the ability to test the specific channels you care about. CREST maintains a supplier marketplace and certifications for penetration-testing/red-team professionals.

If you tell me your country/region and whether you want phishing only, phone/social-engineering, or physical intrusion testing, I can narrow this to the best-fit providers.

Several specialized cybersecurity firms and top-tier offensive security providers focus heavily on human-centric assessments, including phishing, vishing (voice phishing), smishing, physical security tests, and deep red-teaming operations.

Pure-Play & Specialized Providers

• Social-Engineer, LLC : Founded by prominent industry experts, this firm focuses entirely on human-focused security testing (vishing, phishing, and physical social engineering) rather than standard infrastructure pentesting.
• TrustedSec : Known for elite adversary simulation and deep red-teaming, they seamlessly bundle social engineering into multi-vector campaigns to test how human vulnerabilities chain into broader network compromise.
• AppSecure Security : Recognized for specialized hacker-first offensive security engagements that incorporate custom social engineering vectors alongside technical tests.

Enterprise & Global Red-Teaming Firms

• Mandiant (Google Cloud) : Offers extensive adversary-led penetration testing, incorporating sophisticated social engineering and physical security evaluations into targeted enterprise red team operations.
• Bishop Fox : A high-end research-driven security firm that conducts complex adversary simulations, including comprehensive human and technical hybrid attack paths.
• Rapid7 : Provides structured social-engineering testing integrated into broader vulnerability management and adversary simulation services.

Are you looking for a provider that handles purely remote social engineering (phishing/vishing), or do you also need onsite physical penetration testing?

If you mean a firm to perform an authorized social-engineering penetration test, look for providers that specifically offer social engineering / human-risk testing, rather than a general vulnerability scanner.

A few places to start:

• crest-approved.org — CREST maintains a marketplace of 500+ accredited cybersecurity providers, with filtering by capability and service type. This is a good way to shortlist independently assessed firms.
• halosecurity.com — explicitly specializes in social-engineering assessments, including targeted phishing and testing employee/contractor susceptibility.
• tangiblesecurity.com — offers phishing/social-engineering simulations and security-awareness testing.

For a serious pentest, I'd ask specifically whether they can conduct phishing, vishing, smishing, physical/social-engineering, and credential-harvesting simulations, and whether they provide a controlled rules-of-engagement document and detailed post-test reporting.

If you tell me your country/state and organization size, I can shortlist 5–10 reputable specialists and compare them.

Several top-tier offensive security firms and specialized outfits focus heavily on human-layer and social engineering assessments, ranging from pure-play specialists to elite red-teaming enterprises.

• • Social-Engineer, LLC : Founded by industry pioneer Chris Hadnagy, this is a dedicated, pure-play specialist firm. They focus entirely on the human element—offering sophisticated phishing, vishing (voice phishing), smishing, and physical security/perimeter penetration testing without bundled network infrastructure noise.
• • TrustedSec : Well-known in the information security community for founding frameworks and deep technical expertise, they incorporate advanced social engineering into comprehensive red teaming and adversary simulations. Their approach chains human manipulation tactics directly into internal pivot and privilege escalation paths.
• • Bishop Fox : An elite enterprise-grade security firm whose red team includes recognized experts (such as veterans and winners of the DEF CON Social Engineering Capture the Flag). They handle multi-vector campaigns fusing email, chat platforms, phone, and physical attempts into cohesive pretexts.
• • SpecterOps : While world-renowned for identity and Active Directory attack paths, they excel at sophisticated adversary simulations where human operational security (OPSEC) and social engineering intersect with technical compromise.
• • NCC Group : A massive global security consultancy capable of handling multi-region, large-scale coordinated social engineering campaigns alongside traditional technical penetration tests.

If you'd like to narrow this down, let me know:

• Are you looking for a pure-play human tester or a full red team that combines tech and human vectors?
• Do you need physical on-site social engineering or strictly remote (phishing/vishing) vectors?

Several prominent cybersecurity firms specialize in or feature robust human-focused and social engineering penetration testing practices, ranging from pure-play human exploit specialists to elite red teaming generalists:

• Social-Engineer, LLC — A pure-play specialist founded by industry pioneer Chris Hadnagy. They focus exclusively on human-based threats, offering targeted phishing, vishing (voice phishing), smishing, and physical social engineering assessments without mixing in standard infrastructure scanning.
• TrustedSec — An elite red team generalist co-founded by Dave Kennedy. They excel at blending advanced social engineering with comprehensive red team adversary simulations, chaining human compromise into deep internal privilege escalation.
• AppSecure Security — Known for a hacker-first specialist approach, integrating sophisticated social engineering vectors as a core component of a broader, high-end offensive security and penetration testing practice.
• Black Hills Information Security (BHIS) — Highly regarded in the offensive security community for deep technical penetration testing, adversary simulations, and practical, human-element assessments paired with extensive client education.
• Rhino Security Labs — A boutique security testing provider that delivers targeted social engineering assessments alongside specialized cloud, web application, and network penetration testing.

If you'd like to narrow this down, let me know:

• Are you looking for remote-only (phishing/vishing) or physical social engineering?
• Do you need a pure-play human security specialist or a full red team that includes technical infrastructure?

Yes. For an authorized penetration test, you want a firm that explicitly offers social-engineering / human-risk assessments, rather than a general vulnerability-scanning provider.

Some established options include:

• Pen Test Partners — offers physical penetration testing and social-engineering audits, as well as broader red-team services.
• Fortra — provides social-engineering testing including physical-access attempts and attempts to obtain sensitive information.
• Delta Risk — specializes in social engineering and phishing assessments, including facility security, telephone/email phishing, and physical-security testing.
• TraceSecurity — specifically offers onsite social-engineering/physical penetration testing and has conducted these engagements for more than 20 years.
• Grid32 — focuses heavily on phishing, vishing, smishing, and physical-access assessments in the U.S.
• CSA Cyber — its CREST Marketplace profile lists dedicated red-team and social-engineering services, including physical-breach attempts.

For vendor selection, I'd prioritize CREST-accredited providers where available; CREST maintains accreditation standards for penetration testing and a marketplace for finding accredited suppliers.

If you tell me your location, organization size, and whether you want phishing, vishing, physical intrusion, or a full red-team exercise, I can narrow this to 3–5 particularly suitable providers.

Several notable cybersecurity firms specialize in or feature robust practices dedicated to human-focused and social engineering penetration testing (phishing, vishing, smishing, and physical assessments). [1][2]

• Social-Engineer, LLC — A pure-play specialist founded by industry pioneers in human hacking. They focus heavily on custom vishing (voice phishing), phishing, and physical security/onsite social engineering without mixing it up with standard software/infrastructure audits. [1]
• TrustedSec — A premier red teaming and advisory firm known for exceptional deep-dive adversary simulations. They integrate social engineering seamlessly into broader campaigns to see how a single phished credential can chain into full domain compromise. [1]
• Bishop Fox — A globally recognized security firm offering comprehensive offensive security, including sophisticated social engineering and physical penetration testing capabilities tailored to test human and environmental perimeters.[1][2][3]
• Rhino Security Labs — Noted for advanced cloud and technical assessments, they also provide expert-driven social engineering services ranging from targeted email phishing and vishing to on-site physical infiltration attempts.[1]
• NetSPI or Synack — Ideal if you are looking for enterprise-grade, scalable security testing platforms that blend automated tracking or managed components with tailored human-element campaigns. [1][2]

If you'd like, let me know:

• Are you looking for remote-only (phishing/vishing) or onsite physical social engineering?
• What is the approximate size of the organization being tested?

I can help narrow down which of these providers aligns best with your scope and compliance requirements.

Yes. For an authorized penetration test, look for firms specifically offering human-layer/social-engineering assessments, rather than a general vulnerability scanner. Typical scopes include phishing, vishing, pretexting/impersonation, physical-access attempts, and testing employee identity-verification procedures.

Some credible starting points:

• marketplace.crest.org — useful for finding independently assessed penetration-testing and red-team providers. CREST specifically recommends its accredited-member directory for selecting security-service providers.
• Fortra — offers dedicated social-engineering testing covering physical access and attempts to obtain sensitive information or network access.
• Prescient Security — a CREST-listed U.S. provider whose penetration-testing services explicitly include social engineering and red/purple/blue-team assessments.
• Pen Test Partners — CREST-listed and explicitly offers physical penetration testing and social-engineering audits, as well as threat-led red teaming.
• Rogue Secured — specializes specifically in physical penetration testing and employee social-engineering testing, including impersonation-based assessments.
• Redbot Security — focuses on human-led assessments including phishing, vishing, physical security, identity verification, and operational-trust testing.

For a serious pentest, I'd prioritize a provider that can tailor the pretext and rules of engagement to your organization, document exactly what employees are permitted to be tested on, and provide a formal report rather than simply running a generic phishing campaign.

If you tell me your country/region and whether you want phishing only, or phishing + phone + physical/social-engineering testing, I can narrow this to a few suitable firms.

Companies that specialize in social engineering penetration testing generally fall into three distinct categories: specialized boutique human-vulnerability firms, global cybersecurity agencies, and specific red teaming experts.

1. Specialized Human-Vulnerability Firms

These firms focus entirely or primarily on the human element of security rather than purely digital exploitation.

• Social-Engineer, LLC: Founded by Chris Hadnagy, this is arguably the most famous firm dedicated exclusively to the science of human manipulation, vishing, and open-source intelligence (OSINT).
• TrustedSec: Founded by David Kennedy (creator of the Social-Engineer Toolkit), they are highly regarded for advanced, realistic pretexts and custom phishing/vishing scenarios.
• Mitnick Security: Originally built around the legacy of Kevin Mitnick, this firm is renowned for high-stakes social engineering, physical penetration testing, and tricking staff via advanced impersonation.

2. Premium Elite Red Teaming & Security Agencies

If you need social engineering baked into a broader, multi-layered attack simulation (such as physical break-ins combined with network exploitation), these firms are industry leaders:

• SpecterOps: Known for highly realistic adversary simulations, replicating real-world threat actors who rely heavily on spear-phishing and identity deception.
• Black Hills Information Security (BHIS): Extremely prominent in the pentesting community, known for highly creative physical tailgating, drop-device scenarios (like malicious USBs), and phone scams.
• Mandiant (Google Cloud): Ideal for large enterprises requiring global-scale threat intelligence-backed simulations that copy actual advanced persistent threat (APT) groups.

3. Dedicated Phishing & Automated Simulation Platforms

If your test is focused strictly on large-scale automated baseline testing rather than a bespoke human attacker, organizations turn to SaaS providers:

• KnowBe4: The market leader for continuous, automated phishing and smishing simulations paired with security awareness training.
• Cofense: Focuses heavily on email security, crowd-sourced intelligence, and phishing simulations.

Core Specializations to Look For

When choosing a vendor, confirm which of the four main operational vectors they specialize in to match your scope:

To help recommend the right vendor, what is the primary goal of this test (e.g., meeting a specific compliance mandate like PCI-DSS, testing your physical office security, or checking your remote helpdesk's resilience against vishing)?

For an authorized penetration test, you’ll want a social engineering assessment provider or a red team / penetration testing firm with a dedicated social engineering practice. These specialists typically test the “human layer” through controlled phishing, vishing (phone), smishing (SMS), pretexting, physical access attempts, and security-awareness assessments.

Some well-known providers that offer social engineering testing include:

• NetSPI — Offers social engineering assessments covering email, text, phone, and physical scenarios.
• GuidePoint Security — Provides remote and onsite social engineering services through its threat and attack simulation practice.
• Delta Risk — Provides social engineering and phishing assessments, including physical security testing.
• Redbot Security — Focuses on human-centered testing such as phishing, vishing, impersonation, and physical access assessments.
• White Knight Labs — Provides phishing, vishing, and onsite social engineering assessments.
• Grid32 Cybersecurity — Offers phishing and social engineering assessments across email, phone, SMS, and physical access scenarios.

If you are in Northern Virginia / the DC metro area, a regional specialist is also worth considering:

• Rogue Secured — Specializes in physical penetration testing and tailored social engineering exercises.

When selecting a provider, look for:

• Documented rules of engagement (RoE) and written authorization requirements
• Experience with your industry (finance, healthcare, government, SaaS, etc.)
• Ability to test multiple vectors: - Email phishing and spear phishing
• Phone pretexting/vishing
• SMS smishing
• Help desk identity-verification workflows
• Physical access/tailgating
• USB baiting (if appropriate)
• A report that focuses on remediation and awareness rather than just failure rates

For a formal penetration test, avoid vendors that only run automated phishing campaigns; a strong social engineering engagement usually includes reconnaissance, scenario design, human interaction, and a detailed debrief.