Overview

Social engineering is one of the most common attack methods used by criminals to trick employees into downloading malware, using realistic pretexts to pave the way to a security compromise.

Social engineering templates from an outside vendor, built internally, require more work for your security team and only enable basic-level attacks. Typically, the templates do not include attacker reconnaissance, for example, which is often a key part of an attacker’s strategy.

Illustration of red shield

Benefits

Uncover employee vulnerabilities

99%

IBM Security™ X-Force® Red social engineers are able to physically compromise companies in 99% of all engagements. Find out if your employees or executives would fall for an advanced social engineering attack like spear phishing.

Uncover process and policy vulnerabilities

50%

At least half of USB drives dropped by X-Force Red social engineers are opened. Discover how your employees would respond to an attack, and if device policies and training lead them to follow reporting guidelines.

Reduce risk

30%

The click rate for opening malicious emails is still typically about 30%. Discover where your company is vulnerable and remediate flaws to prevent a real attacker from succeeding.

Phishing, vishing and physical engagements

How X-Force Red tests your employees:

  • Distributes emails with malicious links and dangerous file attachments to see who opens them.
  • Calls employees to trick them into divulging sensitive information over the phone.
  • Use disguises, badge cloning, bypassing and other techniques to physically enter buildings and secure areas and identify security flaws.
  • Customizes pretexts, using no set templates or customer resources.

Choose your approach

Attack planning

Person on video call using laptop

Attack planning

At the beginning of every engagement, X-Force Red hackers meet with customers to understand their objectives, present various attack scenarios, develop a game plan and set goals.

Attacker reconnaissance

Person in operations center studying screens

Attacker reconnaissance

X-Force Red performs extensive open-source intelligence (OSINT) gathering to uncover publicly available data about targets that could be used to compromise an organization, person or facility.

Using that intelligence, our hackers identify hosts, configuration files, open ports and other detailed technical information available on external websites, torrents and forums. The team also researches the dark web, social media platforms and search engines.

Physical testing

Person holding tablet in lab setting

Physical testing

For physical engagements, X-Force Red develops a tiered program based on a low, medium and high risk of getting caught. The team aims to complete as many of the defined goals as possible within the two-week period.

Our flexible models

Ad-hoc testing

For projects with an explicit scope and a small number of tests. Uses X-Force Red hackers, but you retain ownership of the testing.

Subscription-based program

Fixed monthly costs for an ongoing testing program. No charges for overtime or to change testing targets. Conveniently manage your tests and budget in one place through the Red Portal or schedule tests directly with your X-Force Red program manager. Unused funds carry over to the next contract year.

Fully managed testing program

Set predictable monthly budgets. With X-Force Red as your strategic partner, we handle the scoping, scheduling, testing and reporting.

Related solutions

Insider threat solutions

Protect your organization from malicious or unintentional threats from insiders with access to your network.

Zero trust security solutions

A zero trust strategy needs modern, context-based security. Protect data and resources by limiting access under the right circumstances.

Fraud prevention and detection solutions

Imagine a secure world without passwords. It’s possible and, even better, already exists. But how do you create this experience for your customers?