The Human Element of Penetration Testing

Every security investment protects the perimeter. People walk through it.

A law firm spends £180,000 on next-generation firewalls, endpoint detection and response, email security gateways, and a managed SOC. The external pen test comes back clean. The internal pen test finds only two medium-severity Active Directory misconfigurations, both remediated within a week. The CISO presents the results to the partnership. Security posture: strong.

Two weeks later, a tester posing as a fire safety inspector walks into the London office unchallenged. The receptionist asks for a name but not for identification. The facilities manager escorts the "inspector" to the server room to "check the suppression system," then leaves to make tea. The tester plugs a rogue network device behind the server rack and walks out through the front door fourteen minutes after walking in.

The same week, a phishing campaign targeting 120 fee earners achieves a 34% click rate and an 18% credential submission rate. Four accounts are fully compromised — including a senior partner with access to active M&A files, client account details, and privileged communication. The email security gateway caught two of the 120 emails. The SOC detected nothing. Three people reported the email as suspicious. The first report arrived 47 minutes after the campaign began.

The technology worked exactly as designed. The people did what people do: they trusted a confident stranger, they clicked a convincing email, and they entered their passwords on a page that looked right. No vulnerability was exploited. No software was compromised. The attack worked because it targeted the one component of the security architecture that no vendor sells a patch for.

What your people believe — and what attackers know they believe.

Every social engineering attack exploits a human assumption — a mental shortcut, a default trust, a social convention that we rely on to function in everyday life but that becomes a vulnerability when an adversary understands it. These aren't stupidity. They're efficiency mechanisms that evolution spent millions of years optimising. Attackers have spent decades learning to abuse them.

Cognitive biases that training cannot override.

The assumptions above aren't random — they're symptoms of well-documented cognitive biases that evolved to help humans make fast decisions in uncertain environments. These biases are not bugs in human cognition. They're features — and they're exploitable precisely because they're reliable.

Security awareness training can teach people the names of these biases. It cannot switch them off. The biases operate below conscious decision-making — which is why the same employee who scores 100% on the annual phishing quiz will submit their credentials on a well-crafted phishing page three weeks later. Knowing about a bias and being immune to it are entirely different things.

The attack that scales and never stops working.

Phishing is the most common initial access vector in real-world breaches and a core component of any human-element penetration test. But effective phishing assessment goes far beyond sending fake emails and counting clicks — it evaluates the entire chain: which pretexts work against which populations, whether the email gateway catches the campaign, whether users report it, and how quickly the SOC responds when they do.

The phone call that bypasses every email control.

Voice phishing — vishing — is dramatically underrepresented in most organisations' security testing programmes. It shouldn't be. A well-executed vishing call exploits authority bias and urgency bias in real time, with the added pressure of a live conversation where pausing to think feels socially awkward. Unlike email, there's no "Report Phish" button and no gateway to block the call.

In our vishing assessments, the success rate for obtaining credentials, MFA codes, or sensitive information via a phone call consistently exceeds the success rate of email phishing campaigns targeting the same population. People who would never enter their password on a suspicious webpage will read their MFA code to a confident caller who says the right words.

Nine credentials, five live MFA codes, three remote access installations — from 24 answered phone calls. Average time to full compromise: four minutes twenty seconds. The longest any caller questioned the tester before complying: eight seconds. One person — out of 24 — reported the call to IT afterwards. The other 23, including the nine who gave their credentials, said nothing.

The test most organisations forget to commission.

Physical security testing is the most visceral form of human-element assessment — and the one that consistently produces the most alarming results. It tests whether an unauthorised person can gain physical access to the organisation's premises, its sensitive areas, and its IT infrastructure through social engineering alone.

The results are almost always the same: they can. Not because the locks are weak, but because the people are polite.

Physical testing reveals a truth that digital-only assessments miss entirely: the most expensive firewall in the world is irrelevant if someone can walk into the building, plug a device into the network, and walk out again. In our experience, they almost always can — and the device is almost never discovered.

Metrics that matter — beyond the click rate.

A phishing simulation that produces only a click rate is a wasted exercise. The click rate tells you how many people fell for this specific pretext on this specific day. It doesn't tell you whether the organisation can detect, report, and respond to a social engineering attack before it causes damage. The metrics that drive real improvement measure the entire response chain.

The click rate (34%) tells part of the story. The vishing success rate (38%) tells another. But the most critical finding spans all three channels: across phishing, vishing, and physical testing, the SOC generated zero alerts. The organisation's detection capability — the £180,000 investment in technology — was not tuned to detect the attacks that actually work. The investment protected against automated threats. The human-element attacks walked past it.

Building defences that survive human error.

If cognitive biases can't be trained away, the security model must change. Instead of trying to make humans infallible, build an architecture that limits the damage when they're fallible — which they will be, because they're human. This means layering technical controls, organisational processes, and cultural norms that collectively reduce the probability of a successful attack and contain the blast radius when one succeeds.

Ethical and effective human-element testing.

Human-element testing is uniquely sensitive. Unlike testing a server or an application, you're testing people — and people have feelings, professional reputations, and anxiety about being judged. The way an assessment is designed, communicated, and reported determines whether it strengthens the organisation's security culture or poisons it.

The bottom line.

The human element is the attack surface that no firewall protects, no scanner detects, and no patch fixes. It's the receptionist who holds the door for the "fire inspector." It's the finance manager who processes the urgent wire transfer without phoning to verify. It's the developer who approves the MFA prompt at 7am without thinking. It's the senior partner who enters credentials on a cloned login page that's pixel-identical to the real one.

These aren't failures of intelligence or professionalism. They're features of human cognition — authority bias, urgency bias, social proof, reciprocity, habituation, commitment — that evolved to help us make fast decisions and that attackers have methodically weaponised. Annual e-learning cannot override millions of years of cognitive evolution. The 68% figure isn't moving because the approach is wrong — not because the training isn't frequent enough.

The answer is architectural, not educational. Training raises awareness. Phishing-resistant MFA eliminates credential theft. Payment verification procedures prevent BEC fraud. Challenge culture addresses authority bias. Physical controls enforce access policy when social pressure fails. Assume-breach design limits blast radius when — not if — a human makes a mistake. And a reporting culture that rewards rather than punishes creates the early-warning system that no technology can replace.

Human-element penetration testing — phishing, vishing, physical access, social engineering — reveals the gap between what the organisation assumes its people will do and what they actually do under realistic adversarial pressure. That gap is where 68% of breaches begin. Closing it requires understanding it first — and understanding it requires testing it.