Social engineering assessment
A social engineering assessment is an authorized evaluation of how people and organizational procedures respond to attempts to manipulate them into disclosing information or taking a security-sensitive action.
What an assessment evaluates
An assessment tests whether a particular control works in an agreed situation. The subject might be a help-desk verification step, an employee reporting route, or an escalation procedure. NIST SP 800-115 discusses social engineering as a way to test both procedures and the human element.
Awareness training teaches people what to recognize and do. An assessment observes what happens in an authorized scenario. Someone completing training does not tell you how they would handle a particular recovery request.
The stopping point changes what you can conclude
A help-desk exercise might stop at the decision to approve an account change, without allowing the change itself. That can test the verification procedure, but it cannot demonstrate account access. Describe the observed decision and the stopping point together so readers understand the result.
Scope and follow-up
Before testing, document authorization, eligible participants and channels, prohibited actions, stop conditions, and evidence handling. NIST’s assessment-planning guidance supports defining the scope and rules before execution.
Report what happened and what remains unknown. An unanswered call is not a successful verification check. Give each process problem an owner and agree how you will retest it.
NIST recommends using results to improve the organization rather than single out individuals.