Vishing assessments by experienced social engineers
Live calls that test your verification process, not your employees, inside rules you set.
Security teams running Keepnet
Vishing assessments test verification under pressure
A vishing assessment is a set of live calls from experienced social engineers to your employees, using pretexts you approve, to test whether verification holds under pressure.
- Caller
It’s the service desk. Can you read me the code we just sent to your phone?
- Employee
I’ll call you back on the service desk number first.
- Caller
There’s no time. You’ll be locked out in five minutes.
- Employee
Then I’ll raise a ticket. Thanks.
of organisations had a phishing, vishing or smishing incident last year.
Help desk social engineering, and beyond
The help desk is requested most. Any team that takes calls can be included.
Most requested use cases
- Password and MFA resets
- Callback to the number on file
- Manager or second approver
- Address and payment detail changes
- Sharing customer or employee data
- Requests that name a senior leader
Not limited to these. Pretexts are built around your own processes.
Teams often in scope
- IT help desk
- Customer service
- Finance
- Executive assistants
- Supplier verification
- Any team that takes calls
Rules you set, team by team
Each department can have its own objective.
- 1
Before the calls
Agreed and signed off
- ScopeTeams, employees and exclusions, signed off by you.
- Objective per teamWhat the caller asks each department for.
- PretextsApproved before go-live. Leaders named only with notice.
- Calling numbersAgreed during scoping.
- 2
During the calls
Held on each call
- Calling windowAgreed days and hours only.
- Never requestedCard, health, ID or other sensitive data.
- On disclosureCategory noted, the line of questioning ends.
- Transferred callsThe caller hangs up.
- 3
After the calls
Reported your way
- Significant findingsReported to you the same day.
- Individual resultsReporting agreed in scope.
- RecordingsEncrypted, deleted after report acceptance.
- ReadoutFindings walked through with your team.
Experienced social engineers make the calls
Senior practitioners
Each conversation adapts to the employee’s answers.
No AI voices
Social engineers hold the calls themselves.
Matched to your regions
UK, Europe and US callers, in English and Spanish.
Vetted, under NDA
Background-checked, under confidentiality.
From scoping call to readout
- 1
Scope and rules
Agreed and signed off.
- 2
Research and pretexts
Built from open sources, approved by you.
- 3
Live calls
In the agreed window, with daily status.
- 4
Report and readout
Rated findings, walked through with you.
What to expect
- avg3 to 5Attemptsper employee
- avg2 to 4 weeksCalling windowfor the calls
- DailyStatuscalls made and outcomes
- avg10 daysDraft reportbusiness days after the last call, then a readout
Vishing assessment reports you can act on
Findings point to the verification steps and policies to strengthen, not to individual employees. This sample combines two Keepnet engagements, anonymised.
- 1 / 8
- 2 / 8
- 3 / 8
Read the other 5 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
Run it as a programme, not once
Monthly or quarterly
Phases on your cadence.
Pretexts rotate
A fresh scenario each phase.
Trend by phase
Results sit next to your phishing simulations in Keepnet.
Run it yourself
Multi-channel phishing simulations, not email-only
Run voice, SMS, email, QR code and callback simulations yourself, from the Keepnet console.
See the Vishing SimulatorReady for your security review
Four current certifications, independently audited. Certificates and the full control set are published at doc.keepnetlabs.com/resources/compliance.
Questions buyers ask
A vishing assessment is a set of live calls from experienced social engineers, using pretexts you approve, to see whether your verification steps and policies hold.
Results come per call and pretext, with rated findings.
In an assessment, social engineers hold each conversation. A simulation runs from a platform your team controls, with AI-agent, text-to-speech or recorded calls.
Calls run under a signed agreement and rules of engagement your organisation signs off before go-live.
Recordings are encrypted and deleted within five business days of report acceptance, under EU and UK GDPR and the published DPA.
Card, health, government ID and other high-sensitivity data are never requested or recorded.
On disclosure, only the category is noted.
Yes. Password and MFA resets, account changes and callbacks to the number on file are the most common scopes.
Senior Keepnet social engineers hold the calls themselves, with no AI voices. Callers are background-checked and under confidentiality.
The calling numbers are agreed with you during scoping.
Scope is set with you: teams, employees and attempts per employee, three to five on average. You get a quote after the scoping call.
Calls run over two to four weeks on average. The draft report follows in around 10 business days, then a readout.
An executive summary, outcomes per call and pretext, findings rated Critical to Informational, and prioritised enhancements.
Nothing punitive. The process is tested, not the person: findings point to verification steps and policies to strengthen, and individual reporting is agreed in scope.
Yes. Phases run monthly or quarterly, with rotating pretexts. Results sit next to your phishing simulations in Keepnet.
Yes. Callers are matched to the region, in English and Spanish. Each division can run as its own campaign.
Yes, through Keepnet's multi-channel phishing simulations, which your team runs from the platform.
Scope your vishing assessment
- Teams and objectivesWho is in scope and what each team is asked for.
- Rules and pretextsBoundaries, calling window and the scenarios to approve.
- Timing and cadenceOne engagement or a monthly or quarterly programme.
Book a scoping call
No cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
A call with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your scoping call is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tabSources
- Gartner, Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management, William Candrick, Alex Michaels, 22 September 2026 (G00860839), 2026 Gartner CISO Role Survey (n=297). Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner's business and technology insights organization and should not be construed as statements of fact. GARTNER is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
- Gartner, Cybersecurity Threat: Deepfake Identity Impersonation, Akif Khan, 28 May 2026 (G00847786), 2026 Gartner CISO Role Survey (n=297).
- Verizon, 2026 Data Breach Investigations Report, p. 16.