Social-engineering engagement methodology

When this governs

Load this first, before any phishing/vishing/pretext/physical skill. Social engineering targets people, so it carries authorization and duty-of-care requirements beyond a normal technical test. This is pentest-only: it is never run against a bug-bounty target, and never against individuals or organizations that have not authorized it in writing.