Active Directory Security Assessments Explained
How Active Directory assessments work: attack paths, assumed-breach testing, common weaknesses such as Kerberoasting and AD CS, and how tests stay safe.
People testing
Phishing Simulation
We run realistic, authorised phishing campaigns that show how your people respond, without capturing real passwords or embarrassing anyone.
Overview
Phishing remains one of the most common ways attackers get their first foothold. Filters catch a lot, but not everything, so how your people respond to the emails that get through matters.
We run realistic phishing campaigns that measure clicks, submissions and reports, then turn the results into practical training. Every campaign runs only with written authorisation from your leadership, uses templates and target lists you approve, and never captures real passwords. The goal is a team that spots and reports phishing, not one that feels caught out.
Scope
What we test
- Click rates on realistic phishing emails
- Credential submission attempts on simulated login pages
- Reporting rates through your phishing report process
- Response time from delivery to first report
- Susceptibility by department or role, never by named individual in shared reports
- Effectiveness of email filtering and warning banners
- Pretexts relevant to your business, such as invoices, file shares or HR updates
- Improvement across repeated quarterly campaigns
Findings
Common issues we find
Generic examples of what this kind of testing tends to uncover. Every engagement is different, and we never share client findings.
High
Credentials entered on a lookalike page
Staff submit details to a convincing login page. In our simulations, submissions are recorded as events only and passwords are never stored.
Medium
Low reporting rates
People recognise a suspicious email but don't know how, or don't bother, to report it.
Medium
No clear reporting button or process
Without a simple report button or address, early warnings never reach the security team.
Medium
Lookalike domains get through filters
Messages from slightly misspelled domains arrive without any external-sender warning.
Info
High-risk roles targeted most successfully
Finance, HR and executive assistants often receive the most convincing lures and need tailored training.
Severity shown is typical, not fixed. We rate each finding on its real impact in your environment.
Approach
How we test it
Get written authorisation
Every campaign starts with written authorisation from your leadership. We agree goals, rules and who needs to know before anything is sent.
Agree templates and targets
You approve every email template, landing page and target list in advance. Nothing goes out that you haven't seen.
Run the campaign safely
We send from dedicated infrastructure, record clicks, submissions and reports as events, and never capture real passwords.
Teach in the moment
Anyone who clicks lands on a short, friendly awareness page explaining what they missed and what to look for next time.
Report and repeat
You get metrics by department, trends over time and practical recommendations. Quarterly programmes show whether behaviour is improving.
Deliverables
What you receive
Every finding comes with proof-of-concept evidence, so your engineers can reproduce it and your auditors can trust it.
Executive summary
A plain-English view of risk for leadership, boards and customers.
Technical findings
Each issue with impact, evidence, reproduction steps and a clear fix.
Free retest
Once you’ve fixed the findings, we retest them and update the report.
Attestation letter
A letter you can share with customers and auditors to show testing was done.
Preparation
What we need from you
We'll confirm the details during scoping. Having these ready helps testing start on time.
- Written authorisation from an appropriate member of your leadership
- The target list of email addresses, with departments
- Allowlisting of our sending infrastructure in your email security tools
- Approval of templates, landing pages and campaign dates
- A contact who can answer staff questions during the campaign
FAQ
Phishing Simulation testing questions
Do you capture real passwords?
No. Our landing pages record that a submission happened, but the content of password fields is never transmitted or stored. The aim is to measure behaviour, not collect credentials.
Who needs to authorise a campaign?
We only run campaigns with written authorisation from your organisation's leadership. We also agree who in your team is told in advance, so genuine reports are handled properly.
Will individuals be named in the results?
Shared reports focus on departments and trends, not individuals. If you need individual data for targeted training, we agree how it is handled and who sees it before the campaign starts.
How often should we run phishing simulations?
A quarterly programme works well for most teams. It is frequent enough to measure improvement without causing fatigue, and lets you vary the scenarios over the year.
Guides
Related services
Internal Network & Active Directory Testing
Assumed-breach testing of your internal network and Active Directory, delivered remotely, to show how far one compromised laptop could go.
External Network Penetration Testing
Testing of everything you expose to the internet, from forgotten admin panels to VPN gateways, with every finding manually validated.
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.