<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-social-engineering-assessments
description: >-
  Plan and execute social engineering assessments including phishing, vishing,
  smishing, physical intrusion testing, pretexting scenarios, and OSINT-driven
  targeted attacks with proper scoping and rules of engagement.
domain: cybersecurity
subdomain: security-awareness
tags:
  - social-engineering
  - red-team
  - vishing
  - physical-security
  - pretexting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1598"]
---

# Performing Social Engineering Assessments

## Overview

Social engineering assessments test the human layer of security through simulated
attacks across email, phone, SMS, and physical vectors. This skill covers assessment
scoping, rules of engagement, pretext development, execution, evidence collection,
and reporting with remediation recommendations.

## Prerequisites

| Requirement | Install |
|---|---|
| Authorization | Signed rules of engagement and scope document |
| GoPhish | Phishing simulation platform |
| Caller ID spoofing | Authorized vishing infrastructure |
| Physical access | Authorized building access for physical tests |

## Commands

| Command | Description |
|---|---|
| `node agent.js scope --vectors email,vishing,physical --targets departments.json` | Define assessment scope |
| `node agent.js pretext --vector vishing --target helpdesk` | Generate pretext for vishing attack |
| `node agent.js execute --plan assessment-plan.json --vector email` | Execute assessment phase |
| `node agent.js report --assessment-id SA-2026-001 --format detailed` | Generate assessment report |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js scope --vectors email,vishing,physical --targets departments.json
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js pretext --vector vishing --target helpdesk
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js execute --plan assessment-plan.json --vector email
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js report --assessment-id SA-2026-001 --format detailed
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
