Human risk management — measure and reduce identity-driven attack paths
Realistic, ethically-bounded phishing, vishing and identity-impersonation campaigns combined with just-in-time awareness — measuring and reducing human-driven attack-path risk.
Where teams get stuck
Generic phishing tests train people to click "report" but do not measure whether human-driven access actually leads to a business-impact attack path. Awareness fatigue grows; risk does not move.
How we engage
KeenSafe ties human-targeted campaigns to validated downstream paths — credentials harvested are tested against MFA, lateral movement and privilege escalation. Awareness training is delivered just-in-time, in context, and measured by reduction in real path success rates.
Four-step engagement model
Same rigour every engagement, calibrated to your environment, threat model and regulatory exposure.
Targeted campaign design
Realistic pretexting, sector-appropriate content, scope-bounded targets.
Multi-channel execution
Phishing, vishing, smishing, MFA fatigue and identity impersonation, with safe-by-default controls.
Path validation
Harvested access tested against business-impact paths — does this credential reach a crown jewel?
Just-in-time awareness
Contextual training served at the moment of risk, with measurable behavior change.
Deliverables
Every engagement ships these outputs — reproducible, evidence-backed and ready for executives, engineers and auditors.
Human risk score per group
Measured exposure by department, role and seniority — not vanity click rates.
Path-validated harvested credentials
Were the harvested creds usable to reach a real crown-jewel system?
Just-in-time awareness
Training served at the moment of failure, with re-test follow-up.
Executive risk narrative
Board-grade view of human-driven attack-path risk, not click-rate vanity metrics.
What this engagement covers
Concrete coverage. Clear boundaries. Optional add-on tracks where customers want to extend.
- Realistic phishing campaigns (sector-appropriate pretexting, ethical bounds)
- Vishing campaigns (phone-based pretexting under signed scope)
- Smishing + MFA-fatigue + push-bombing simulations
- OAuth consent-phishing campaigns (M365 / Google Workspace)
- Identity impersonation simulations (BEC scenarios under explicit scope)
- Harvested-access validation: do captured creds chain into Tier-0?
- Just-in-time awareness delivered at moment of failure
- Per-group, per-role, per-seniority risk scoring
- Executive-track (impersonation, BEC, board-targeted) under signed scope
- In-person social engineering (tailgating, badge cloning) under physical-engagement scope
- Continuous quarterly retainer with evolving pretext library
- Custom training content tailored to your sector
- ✕Industrial espionage scenarios (out of ethical scope)
- ✕Personal-life targeting of individuals (strict prohibition)
- ✕Without explicit HR + legal sign-off: no executive impersonation
How we deliver
- CISO + IT leadership
- HR + people-leadership partnership
- Executive impersonation track requires explicit board sign-off
What lands on your desk
Sections customers actually see in the engagement deliverable.
- 01Per-group risk score
Department / role / seniority resolution; tracked longitudinally across campaigns.
- 02Path-validated harvested credentials
For each captured credential set: would it chain into a real Tier-0 / crown-jewel reach?
- 03Just-in-time awareness outcome
Which trainees received contextual training at moment of failure; behaviour change measured next cycle.
- 04Executive risk narrative
Board-grade view of human-driven attack-path risk — replaces click-rate vanity reporting.
Techniques covered
Frameworks & regulations
Frequently asked
How is this different from KnowBe4 / Hoxhunt?
Can you target executives?
What about MFA fatigue?
Pairs well with
Managed red teaming
Objective-oriented engagements aligned to specific threat actors and crown-jewel outcomes. Multi-vector attack chains, evasion-aware tradecraft, and a purple-team debrief that upgrades both prevention and detection.
Read moreManaged penetration testing
Senior offensive consultants combine the KeenSafe platform with manual depth across external, internal, web, mobile, API and cloud surfaces — delivering reproducible attack-path evidence, not screenshots.
Read moreExecutive cyber awareness
Boardroom-level briefings on cyber risk, attack-path economics and security governance — built for executives, board members and non-technical leaders.
Read moreWork with the team behind KeenSafe
Continuous adversarial validation, managed security operations and executive-grade risk visibility — delivered by senior offensive security engineers.