We sent fake emails and caught their passwords, employees are angry

This is exactly what we experienced. Your time to detect an issue directly determines its cost.

Of course, it varies if your situation is different.

Yes, that's exactly how it is with social engineering test. When you try to change everything at once, nothing settles.

Hasty decisions become decisions you have to fix six months later. This is my opinion, I'm not claiming it's absolute truth.

The discussion got scattered, let me summarize. If permission and scope aren't in writing, don't start that test.

Hope this helps.

Let me summarize the topic, since several different answers were given. Most incidents start with a leaked password, not a vulnerability.

Forgotten test environments are more often the entry point than live systems. That's all, sorry if I went on too long.

My question might sound amateurish sorry about that. Having backups accessible on the same network and with the same identity makes them part of the target.

This thread is archived. Don't hesitate to ask; those who don't ask always pay more.

Payment information changes are never verified through the channel they came from.

I feel the same way. Forgotten test environments are more often the entry point than live systems.

Proven by experience.

Let's separate the concepts, they're getting mixed up. If you don't write this down from the start, it leads to arguments later.

Just leaving this note, it might be useful.

Youre right.

Timely topic.

Saved. Taking notes for two weeks yields better results than a six-month estimate.

Having backups accessible on the same network and with the same identity makes them part of the target... I mean if you post the result here it will help others too.

I'm a small business, let me explain from my side. Payment information changes are never verified through the channel they came from.

Start with a small trial; don't commit to everything at once.

Let me write how it's done in practice. If it's your first time, start small; scaling comes later.

That's all, sorry if I went on too long.

I agree.

I have no experience with social engineering test, so I'm asking. If it's your first time, start small; scaling comes later.

Correct me if I'm wrong.

i've been down this road, let me tell you. when making a decision, first look at what data you have on hand.

correct me if Im wrong.

There's a trap here, let me mention it. Trying to do this alone is the most expensive way.

An untested backup is not a backup. This is my opinion, I'm not claiming it's absolute truth.

following. everyone rushing into social engineering test gets suck at the same point.

of course it variies if your situation is different.