Frequently Asked Questions

Every engagement runs under a signed agreement, our Rules of Engagement and a signed Authorization Letter. The letter is signed only by someone with documented authority over the premises, systems and companies in scope. We do nothing without prior written authorization, and we turn down any engagement where that authority can't be confirmed.

Operators carry a physical, tamper-evident Authorization Letter on their person at all times, along with government-issued identification and direct contact details for your authorized executive sponsor. If an operator is detained or confronted, they immediately present this document and request that security or law enforcement contact the primary internal contact to de-conflict the situation. We verify internal emergency contacts prior to launch to ensure instant de-escalation.

No. Our testing is non-destructive and designed to run entirely in the background. We do not disrupt operational lines, cut power, pick locks that could compromise door integrity, or deploy aggressive malware that causes system downtime. If a scenario encounters an unexpected operational bottleneck, the test for that path is paused immediately.

We never take data from your systems. We operate under a strict "benign proof" standard. To prove unauthorized access was possible, an operator leaves an audit sticker on a network port, takes a photograph of a locked computer screen in an empty office, or captures an obfuscated configuration setting. We do not browse internal file shares, copy customer databases, view payroll figures, or record sensitive credentials.

We do keep the evidence a campaign produces: timestamped logs, photos of premises and of our markers, and call recordings where your scope includes them. It is encrypted, goes only to your trusted agents, and is destroyed on a fixed schedule. See Security for the details.

Every test has strict boundaries defined in the Rules of Engagement:

• Pre-approved boundaries: Clear white-lists of physical spaces and departments in bounds, and absolute black-lists (e.g., executive homes, child care facilities, physical server power controls) that are strictly out of bounds.
• Stop-the-clock criteria: Instant halt triggers if an operational emergency occurs on-site or if an authorized sponsor issues a pause signal.
• Continuous oversight: Every operational action is logged with exact timestamps and geographic tags for complete post-engagement auditability.

No. The product is the policy gap, not the employee. Our deliverables never include the names, titles, or direct identifiers of individuals who granted access, transferred a call, or held a door. Human error indicates an ambiguous process, missing safeguards, or an organizational culture that prioritizes speed over verification. We frame all findings around systemic process improvements, turning mistakes into coaching opportunities rather than HR disciplinary issues.

No. An announced test measures how well employees perform when they know they are being graded; an unannounced test measures your actual security posture on a standard Tuesday afternoon. Only a small, pre-designated group of "trusted agents" (typically the CISO, General Counsel, or Head of Operations) knows the campaign is active.

We do not use high-stress pretexts. Operators do not impersonate emergency services, fabricate personal family emergencies, threaten an employee’s job, or exploit traumatic situations. Pretexts remain professional and plausible: an auditor, a facilities vendor, an unfamiliar regional colleague, or a delivery courier needing a signature.

Automated phishing tools test whether employees can spot obvious generic emails, and penetration tests look for unpatched software bugs. Neither tests whether a convincing caller can talk your accounting clerk into changing wire payment details, or whether an unfamiliar face can walk through your warehouse loading bay and sit down at an active dispatch terminal. We evaluate the seam where human habits intersect with business operations.

You receive an executive-ready operational debrief within five business days of campaign completion:

• Executive Summary: A plain-English risk translation for executive leadership, illustrating how identified gaps map to wire fraud, operational downtime, or regulatory exposure.
• Vulnerability Log: A chronological, timestamped timeline of every attempt, describing the policy breakdown, how access was achieved, and why internal controls failed to stop it.
• Remediation Roadmap: Concrete, non-disruptive operational adjustments—such as dual-authorization call scripts, reception check-in revisions, and simplified internal escalation protocols.