What Does a Social Engineering Assessment Report Include?

A Report Designed for Multiple Audiences

Like our network and web application reports, social engineering deliverables are designed to be useful to multiple audiences — from leadership making risk decisions to HR teams managing employee follow-up to IT teams tuning email filters and security controls.

Campaign Overview and Statistics

For each campaign type conducted (email, phone, SMS, physical), the report includes high-level statistics: number of individuals tested, open rates, click rates, credential submission rates, and call interaction rates. Presented with clear visual charts that make trends and outliers immediately apparent.

Progression and Sophistication Analysis

Because Grid32's campaigns are staged — starting broad and escalating in sophistication — the report shows at what level of attack sophistication your defenses and users begin to fail. This is more actionable than a simple pass/fail rate.

Individual-Level Results

Where authorized by the client, individual-level results are included — identifying which users fell for which campaigns. This enables targeted follow-up training for the highest-risk individuals, which is significantly more effective than organization-wide generic training.

Technical Findings and Recommendations

The report also covers how email filtering systems performed, whether phishing infrastructure was detected, how quickly alerts were generated, and specific configuration recommendations for email security controls. Every report concludes with prioritized recommendations spanning technical controls, policy changes, and training recommendations.