Vishing & pretexting

When it applies

The engagement authorizes live-interaction testing (cleared via social-eng-methodology) and the objective is a process test: will the help desk reset a password or MFA without proper verification? Will an employee act on a convincing caller? This targets procedure adherence, which phishing email can't measure. Help-desk MFA-reset abuse is a leading real-world initial-access vector, so testing it is high-value.

Why it works

Voice adds urgency, authority, and social pressure that written channels lack — a confident caller with a few true details (from recon-osint) and a plausible reason routinely gets a human to skip a verification step. The finding is the gap in the verification procedure, not the individual who answered.