Social engineering testing companies: compared

Social engineering penetration testing checks whether people and procedures resist a trick, such as a fake email, a call to the help desk or a visitor who asks for a door to be held open. This page lists providers whose own pages state social engineering as a service. Facts come from the PentestCompare dataset, checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

What does social engineering testing cover?#

It covers attempts to make a person reveal information or perform an action. NIST SP 800-115 section 5.3 defines social engineering as "an attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks". It says the test can reveal weaknesses in user behavior "such as failing to follow standard procedures".

NIST names analog means (conversations in person or by telephone) and digital means (email, instant messaging). Phishing is the best known digital form. Providers sell these methods under several names:

The table does not split these methods. Open each provider page, or ask for a method list in writing.

Who needs a social engineering test, and when?#

Buyers need one when staff handle sensitive data or reset credentials, when a regulator or customer asks for awareness evidence, or after an incident that started with a phone call or an email. It also suits a company that already tested its network and applications and wants to learn whether an attacker could skip them by asking.

NIST says targets can be specific, such as executives, or a broad set of staff, and that specific targets are chosen when the organization knows of a threat to them. Decide which of the two you want before you request quotes.

What should you ask a social engineering testing provider?#

Ask these questions before signing:

1. Which methods are in scope (email, phone, text, on-site), and which are excluded?
2. Who approves the pretexts, and will you show us the scenarios first?
3. How do you report: by named person, by team or by total?
4. What happens when a staff member reports the attack? Do you stop?
5. How do you store the data you collect, and when do you delete it?
6. What actions are off limits (for example, real payments or access to real patient data)?
7. Do you provide a sample report?

Rules of engagement matter more here than in a network test, because the targets are people. Get written authorization from the system owner. Our questions to ask a pentest provider covers general contract points.

What drives the price of a social engineering test?#

Price follows the number of targets, the number of methods, how much research each pretext needs, the length of the campaign and whether any on-site visit is in scope. Custom pretexts cost more than a template email. Reporting by individual adds data-handling work.

Most providers in the table quote after scoping, and a few list a price for a product or tier. Compare only after you fix the same method list and number of targets.

How should you read the table?#

Each row shows what that provider says on its own pages. "Not published" means we found no statement. The dataset shows human-led and hybrid delivery for this service. Check the provider page to see whether a person writes the pretexts, or a tool sends template campaigns.

The Sample report column matters here, because a report on social engineering can show how the provider treats employees. Prefer a provider that reports patterns and fixes over one that lists names.

What scoping mistakes do buyers make?#

Common mistakes:

• Telling no one in HR or legal, then facing complaints after the test.
• Running the test with no plan for a staff member who reports the attack.
• Allowing pretexts that use real events such as layoffs or illness, which can harm staff.
• Measuring only click rate, which says little about calls or visits.
• Keeping raw data for longer than the report needs.

See the pentest provider directory for other service types and the network penetration testing page for the technical side.