What is social engineering testing for Indian companies?
Key takeaways
- Social engineering testing needs written consent from every person approached, including a named opt-out, because the person being tested is the one giving consent, and one signed record per person is what you keep.
- Indian social engineering tests typically cost Rs 25,000 to Rs 1,50,000 for a 100 to 500 employee organisation, priced per wave and per channel.
- Payment fraud and business email compromise in India are social engineering at the end of the chain, which is why the payroll and finance teams are the priority targets, and one test on those 2 teams is worth more than 10 on the whole floor.
- Under the IT Act, 2000, impersonating a bank, a government official or a company executive to extract credentials or money can be an offence regardless of intent.
- A well-run test reports a testing and consent record for every person approached, because that record is what an employer needs if the simulation is later challenged, and one record per person keeps it defensible.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does social engineering testing cover?
Five channels, in ascending order of risk. Email phishing, the baseline. Smishing, SMS and WhatsApp lures, which is where most Indian consumer and SME fraud actually arrives, and which is much less filtered by corporate mail gateways. Vishing, where a tester calls a number and impersonates a bank, a courier, a customer or an IT helpdesk, and where the call itself carries the authority. Physical testing, covering reception desks, tailgating, badge cloning, and printers and whiteboard harvesting, which is a genuine weakness in Indian offices with open floors. And impersonation, where the tester poses as a vendor, a recruiter or a senior executive to extract a document, a code or an approval. Each channel produces a different finding, and a business that only tests email has tested the easiest one.
How is a social engineering test scoped legally?
Carefully, because the targets are people. The engagement needs written management approval, a defined population, a set of permitted channels and techniques, and a written statement of the prohibited actions, which for most organisations includes no real credential collection, no actual data removal, and no impersonation of a bank, a government authority or a law-enforcement body without a specific written exception. Every person approached signs a consent and testing record, and a named opt-out list exists so anyone can decline without explaining why. The report records what was sent, to whom and when. That record is the artefact that protects the organisation, because the alternative is an employee believing they were phished by a criminal rather than by a contracted tester, which is a genuine and common harm from a badly run exercise.
What should an Indian company test first?
Three groups, in this order. Finance and payroll, because a request that changes bank details is the scenario that actually costs money, and in Indian companies the request usually arrives as a plausible email or a call to an accounts assistant rather than to the CFO. The leadership and their personal assistants, because impersonating a senior executive is a standard technique and Indian business structures mean the assistant often has the authority to release a payment file or a document. And the IT helpdesk and HR, because password reset and onboarding flows are the soft underbelly, and a convincing call from a fake IT support desk is still one of the most successful routes into a corporate network. Test these three with a professional, with consent, before testing the wider workforce.
What does a social engineering test cost, and what do you get?
Roughly Rs 25,000 to Rs 1,50,000 for a 100 to 500 employee organisation, with per-employee pricing for larger rollouts and per-wave pricing for multi-channel campaigns. You get the lure set and landing pages, the consent and testing records for every person approached, the wave-by-wave results broken down by department, and a management report. The part worth paying for is the training content that follows, because a test that produces a report and no behaviour change has moved no metric. In most Indian engagements the reporting rate, the time to first report and the credential submission rate are the three numbers to put in front of the management, and the credential submission rate should be zero, so any non-zero figure is a control failure worth fixing immediately.
| Channel | Typical approach | What it usually reveals |
|---|---|---|
| Email phishing | Fake invoice, KYC or payroll update | Gateway gaps and finance staff susceptibility |
| SMS and WhatsApp smishing | Courier fee, bank alert, parcel link | Almost no corporate mail filtering applies here |
| Vishing | Call impersonating IT helpdesk, bank or courier | Helpdesk verification process weakness |
| Physical testing | Reception, tailgating, badge, whiteboard | Visitor control and open-floor exposure |
| Impersonation | Fake vendor, recruiter or senior executive | Document and payment approval weaknesses |
What are the frequently asked questions?
Get a straight answer on this
Send us your employee count and the departments you want covered, and we will return a channel plan, a consent process and a fixed price band.
Send us the details See pricing