Social engineering testing is an authorised, controlled attempt to trick your people (by email, phone, SMS or message) into clicking, sharing credentials, approving an MFA prompt or moving money, so you can see how your staff and your technical controls hold up against the attacks that cause most Australian breaches. A phishing simulation is the most common form. At Aussie Pentest, social engineering assessments are included in our Advanced penetration test, which starts from $20,000 + GST and also covers external and internal networks, web applications and APIs.
This guide explains what social engineering testing covers, how it differs from awareness training, what it costs in Australia, how to run it safely and fairly, and when an SMB actually needs it. If you're still working out whether you need a pentest at all, start with do small businesses need penetration testing?
What is social engineering testing?
Social engineering testing measures how easily an attacker could manipulate your people, processes and supporting controls into giving up access, information or money. It's a security assessment of the human layer, run with written authorisation, an agreed scope and clear rules on what testers can and can't do.
The OAIC defines social engineering/impersonation as an attack that "relies heavily on human interaction to manipulate people into breaking normal security procedures and best practices." Testing puts realistic versions of those attacks in front of your team, in a controlled way, and records what happens.
Common techniques in scope include:
- ▸Phishing simulations. Realistic emails that encourage staff to click a link, open an attachment or enter credentials on a look-alike login page.
- ▸Spear phishing. Targeted messages to specific roles (finance, executive assistants, IT admins) using publicly available information.
- ▸Vishing (voice phishing). Phone calls pretending to be IT support, a supplier or an executive to obtain passwords, MFA codes or a password reset.
- ▸Smishing and messaging lures. SMS or chat messages that point to credential-harvesting pages.
- ▸MFA fatigue and approval abuse. Checking whether staff approve unexpected push prompts.
- ▸Help desk and process testing. Whether your IT support or MSP will reset a password or MFA method for a caller who can't prove who they are.
- ▸Payment redirection pretexts. Whether a "supplier" email asking to change bank details would be actioned without call-back verification.
What it is not
It isn't a scheme to catch out individuals, and it isn't a replacement for technical testing. A good engagement reports on patterns and controls ("finance has no call-back step for bank detail changes") rather than naming and shaming the person who clicked.
Why does social engineering testing matter for Australian businesses?
Because most attacks on Australian organisations still involve a person being tricked at some point, and Australian data shows it. The numbers below come from the two most useful official sources for SMBs.
- ▸The Australian Signals Directorate's (ASD) Annual Cyber Threat Report 2024–25 says phishing, "a type of social engineering", was recorded in 60% of the incidents reported to ASD's Australian Cyber Security Centre (ACSC) in FY2024–25. The same report notes that attackers use generative AI to produce "fake voices", websites and spear phishing emails that look more legitimate with little effort.
- ▸ASD's report also lists business email compromise (BEC) fraud resulting in financial loss as 15% of self-reported cybercrime for businesses, and puts the average self-reported cost of cybercrime per report at $56,600 for small businesses and $97,200 for medium businesses.
- ▸In the OAIC's Notifiable Data Breaches Report for July to December 2024, phishing (compromised credentials) was the leading cause of cyber incidents (84 of 247), and social engineering/impersonation accounted for 115 of the 404 breaches caused by malicious or criminal attacks.
- ▸The OAIC also received 1,205 data breach notifications in the 2025 calendar year, the highest since the Notifiable Data Breaches (NDB) scheme began in 2018.
In practice, the pattern we see in SMB environments is consistent: the technical controls are often better than the process controls around them. MFA is switched on, but nobody has tested whether staff will approve a prompt they didn't trigger, or whether the help desk will reset MFA for a convincing caller.
How is social engineering testing different from security awareness training?
Awareness training teaches people what to look for. Social engineering testing measures whether that training, and the controls behind it, actually work under realistic pressure. You usually want both, but they answer different questions.
| Security awareness training | Social engineering testing | |
|---|---|---|
| Question answered | Do staff know what phishing looks like? | Would a realistic attack succeed here? |
| Format | Courses, videos, quizzes, briefings | Authorised simulated attacks with a defined scope |
| Measures | Completion rates, quiz scores | Click, credential entry, MFA approval, reporting and process failure rates |
| Tests processes and controls? | Rarely | Yes: email filtering, MFA, help desk, payment verification |
| Output | Training records | Findings report with prioritised fixes |
| Best used | Ongoing, for everyone | Periodically, to validate training and controls |
Many training platforms include built-in phishing templates, which are useful for keeping people sharp. An independent social engineering assessment goes further: it's tailored to your organisation, uses pretexts an attacker would realistically use against you, tests phone and process paths as well as email, and reports on the technical controls that should have stopped the attack before a person ever had to decide.
What does a social engineering assessment cover?
A useful assessment tests the whole chain: whether the lure gets through, whether people act on it, whether controls limit the damage, and whether anyone reports it. The exact mix depends on your risk, but a typical SMB scope looks like this.
1. Reconnaissance (what attackers can learn about you)
Testers review what's publicly available: staff names and roles on your website and LinkedIn, email address formats, supplier relationships, and anything that makes a pretext more believable. This often surfaces quick wins on its own, such as an org chart that hands attackers a target list.
2. Email phishing and spear phishing
Simulated emails are sent to an agreed group of staff. Metrics usually include:
- ▸Delivered vs blocked by your email security
- ▸Opened links and attachments
- ▸Credentials submitted to a test page
- ▸MFA prompts approved
- ▸Messages reported to IT or security, and how quickly
The reporting rate matters as much as the click rate. A team that clicks occasionally but reports quickly gives you a much better chance of containing a real attack.
3. Vishing and help desk testing
Testers call staff or your IT support (internal or MSP, with the MSP's agreement) using agreed pretexts, such as a locked-out executive or a new supplier. The goal is to check identity verification, not to bully anyone into compliance.
4. Process and payment controls
For many SMBs the most expensive social engineering outcome isn't a stolen password; it's a redirected invoice payment. Testing can check whether bank detail change requests trigger an independent call-back, and whether urgent "CEO" payment requests can bypass approvals.
5. Technical controls behind the human layer
A strong assessment also reports on what the controls did: email authentication and filtering, link and attachment handling, MFA type and configuration, conditional access, and whether a captured credential would actually have worked. This is where social engineering testing and penetration testing overlap.
How does social engineering fit into a penetration test?
Social engineering is one way into your environment. A penetration test shows what an attacker could do once they're in. Together, they show the full path from a phishing email to the data or systems that matter. That's why at Aussie Pentest social engineering sits within our Advanced engagement rather than being sold as a stand-alone gimmick.
| Tier | From | Social engineering included? | Best for |
|---|---|---|---|
| Basic | $5,000 + GST | No | External network test, up to 25 IPs |
| Standard | $12,000 + GST | No | External and internal network, up to 50 IPs and 2–3 web apps |
| Advanced | $20,000 + GST | Yes | Full-scale test: external and internal networks, web apps, APIs and social engineering assessments |
All tiers are fixed-fee, scoped in writing before testing starts, and include a severity-ranked report with proof-of-concept evidence on every critical finding. Prices are AUD + GST; international clients are GST-free. See the full breakdown on our pricing page.
If your main concern is the network itself, our guides to network penetration testing and external vs internal testing explain those scopes. If a full Advanced engagement is more than you need right now, tell us during scoping and we'll talk through what a narrower exercise would involve and quote it in writing.
How much does social engineering testing cost in Australia?
At Aussie Pentest, social engineering assessments are included in the Advanced penetration test, from $20,000 + GST. That price covers a full-scale engagement across external and internal networks, web applications and APIs as well, so you're testing both the human entry point and what happens after it.
What changes the price of the social engineering component:
- ▸Number of staff and roles in scope. A targeted test of finance and executives is different from an organisation-wide campaign.
- ▸Channels. Email only, or email plus phone, SMS and help desk testing.
- ▸Number of campaigns. One campaign gives a snapshot; repeated campaigns show whether behaviour is improving.
- ▸Pretext complexity. Generic lures are faster to build than tailored spear phishing based on your suppliers and workflows.
- ▸Third parties. Testing your MSP's help desk requires their written agreement and coordination.
- ▸Reporting depth. Department-level metrics, executive briefings and control mapping take more time than a single summary.
Not ready for a human-led engagement yet? An automated security assessment from $80 checks your internet-facing web exposure quickly, but it doesn't test people or phishing defences. For more on cost drivers across all testing types, read penetration testing costs for SMBs in Australia.
When does an Australian SMB need social engineering testing?
You need it when people and processes are a realistic path to your money, data or systems, and you want evidence rather than assumptions about how they'd respond. Common triggers:
- ▸You've rolled out awareness training and want to know whether it changed behaviour
- ▸Finance staff can change supplier bank details or approve payments by email
- ▸You've recently moved to Microsoft 365 or Google Workspace, or changed MFA methods
- ▸Your IT support or MSP resets passwords and MFA over the phone
- ▸A client, tender, insurer or board is asking how you manage phishing and BEC risk
- ▸You hold sensitive personal information covered by the Privacy Act
- ▸You've had a near miss: a successful phish, an invoice scam attempt or an account takeover
- ▸You're planning an Advanced or full-scale pentest and want the human attack path included
If none of these apply yet, a sensible order for many SMBs is: fix the technical basics, train staff, then test.
How does social engineering testing support Australian compliance?
Social engineering testing won't make you compliant on its own, but it's practical evidence that you've tested the controls attackers target most often.
- ▸Privacy Act (APP 11) and the NDB scheme. If you're covered by the Privacy Act, APP 11 requires reasonable steps to protect personal information. The OAIC's APP 11 guidelines say reasonable steps should include strategies covering "governance, culture and training" alongside ICT and access security. Testing whether staff and processes resist phishing supports a reasonable-steps argument. See our guide to Privacy Act cyber security requirements.
- ▸Essential Eight. ASD's Essential Eight maturity model requires MFA at Maturity Level One, and at Maturity Level Two expects MFA used to authenticate users of online services to be phishing-resistant. Social engineering testing shows whether your current MFA would actually stop a credential-phishing attack. An Essential Eight assessment ($4,950 + GST, up to 50 seats) measures control maturity; social engineering testing checks how people and controls behave under a live lure.
- ▸APRA CPS 234. APRA-regulated entities must systematically test the effectiveness of their information security controls. Where people and processes are part of those controls, social engineering testing can contribute. See our CPS 234 penetration testing guide.
- ▸Cyber insurance. Insurers commonly ask about phishing training, MFA and payment verification. A recent test report gives you a factual answer. See what Australian insurers actually require.
How do you run social engineering testing safely and fairly?
Get written authorisation, agree the rules of engagement in advance, protect staff data, and treat results as a control problem rather than a people problem. This is the part SMBs most often underestimate.
- Get authorisation from the right person. A director or executive with authority over the systems and staff in scope should sign off in writing.
- Agree what's off limits. Common exclusions include threats, fake bonuses or redundancy notices, personal accounts, family pretexts and anything that could cause real distress.
- Involve third parties properly. If your MSP, email provider or outsourced help desk is part of the test, get their written agreement first.
- Use a "trusted agent". One or two internal contacts know the test is running and can stop it, confirm whether a report is real, and prevent a simulated lure becoming a real incident response.
- Protect test data. Credential capture pages should prove submission without storing real passwords. Results should be stored securely and only for as long as needed.
- Report on patterns, not people. Share department or role-level trends with leadership. Individual coaching, if any, should be supportive and private.
- Debrief and retrain. Use the findings to update training, processes and technical controls, then test again.
If you suspect a real social engineering attempt during or outside a test, ASD's advice is simple: don't engage, don't delete or forward it, and report it immediately to your IT or security team.
What should you fix after a social engineering test?
The best fixes reduce how much any single click can cost you. Expect recommendations across three areas.
Technical controls
- ▸Move to phishing-resistant MFA (such as passkeys or security keys) for email, remote access and admin accounts
- ▸Tighten conditional access, legacy authentication and mailbox forwarding rules
- ▸Review email authentication (SPF, DKIM, DMARC) and filtering policies
Processes
- ▸Independent call-back verification for any bank detail change or unusual payment request
- ▸Strong identity checks before help desk password or MFA resets
- ▸A simple, well-known way for staff to report suspicious messages
People
- ▸Short, role-specific training based on what actually worked in the test
- ▸Recognition for fast reporting, not just low click rates
- ▸A follow-up campaign to measure improvement
Frequently asked questions
Is phishing simulation legal in Australia?
Yes, when it's authorised by the organisation and scoped responsibly. Testers must only target systems, accounts and staff the organisation has authority over, with written approval, and should handle any personal information collected in line with the Privacy Act. If third parties such as an MSP are involved, their agreement is needed too.
Should we tell staff before a phishing simulation?
Most organisations tell staff that phishing simulations happen as part of the security program, without announcing specific dates or lures. That keeps results realistic while staying transparent. A small group of trusted contacts should know the details so they can respond appropriately.
How often should we run social engineering testing?
Many organisations run lighter phishing simulations throughout the year and a deeper, independent social engineering assessment when risk changes, such as after new systems, new finance processes or a near-miss incident. Our guide to how often you should get a penetration test covers cadence more broadly.
Can you test just finance or executives?
Yes. Targeted testing of high-risk roles is often more useful than an organisation-wide blast, especially for payment redirection and executive impersonation risks. Scope it during the planning call.
Does phishing-resistant MFA make social engineering testing unnecessary?
No. Phishing-resistant MFA significantly reduces credential-phishing risk, but attackers can still target payment processes, help desk resets, approval steps and devices. Testing confirms whether the MFA is deployed everywhere it should be and whether the processes around it hold.
The bottom line
Social engineering testing shows whether a realistic phishing email, phone call or payment request would succeed against your business, and which controls would or wouldn't limit the damage. For Australian SMBs, where phishing and business email compromise remain constant threats, it's one of the most practical ways to validate awareness training, MFA and payment processes, and to show reasonable steps under the Privacy Act. At Aussie Pentest, social engineering assessments are included in our Advanced penetration test, from $20,000 + GST, alongside network, web application and API testing.
Want to know whether social engineering belongs in your next test? Book a 1-on-1 call and we'll help you scope it with a fixed-fee quote. You can also explore our penetration testing services or ongoing vCISO advisory if you want help building a longer-term security program.
Sources
- ▸Aussie Pentest: Penetration Testing
- ▸Aussie Pentest: Pricing
- ▸ASD: Annual Cyber Threat Report 2024–25
- ▸ASD: Essential Eight maturity model
- ▸OAIC: Notifiable Data Breaches Report, July to December 2024
- ▸OAIC: Data breach notifications increase to all-time high in 2025
- ▸OAIC: APP Guidelines Chapter 11, Security of personal information
This article is general information only, not legal or compliance advice. Prices are current as of October 2026 and statistics and regulatory references were checked in October 2026. Check your own situation with a qualified adviser, and only run social engineering tests against people, systems and processes you have written authority to test.