One convincing email, phone call or text message can bypass technical security and established processes. We prepare a realistic attack based on your operations and safely test where it could succeed.
Money, sensitive data or operations. Three different organisations show where the right pretext at the right moment can lead.
CZK 46 million
Attackers posing as police officers and bank employees persuaded an employee to make repeated transfers totalling approximately CZK 46 million.
Data breach
The attack affected the group's non-banking operations. Its public statement cited human error and inconsistent enforcement of rules. Banking systems were not affected.
Weeks of disruption
A ransomware attack crippled the hospital's information systems and severely disrupted its operations. The case was linked to a large-scale phishing campaign.
These cases are based on publicly available sources. BOIT was neither a supplier nor an investigator in these incidents.
Different people, processes and habits, and so different routes an attacker will try to get in. First, we find out what you need to test. Only then do we choose a suitable scenario.
Planted flash drives, QR codes or documents with seemingly sensitive content. We check whether people connect, open, report or properly hand them in.
A fake invitation, a colleague's request, a technical support call or targeted communication exploiting authority, trust and time pressure.
Fake invoices, changed bank details, service logins, urgent management requests or fraudulent text messages targeting a specific process.
These are not fixed packages. We combine individual methods according to your organisation's risks.
Public attention comes only when money is stolen, data leaks or operations stop. Yet it often begins with a single seemingly ordinary situation.
A message or caller fits into an ordinary working day.
Authority, urgency, curiosity or fear of the consequences.
Clicking, signing in, opening a file or passing on information.
A check is skipped, a warning does not arrive or a rule is ignored.
Money, data, system access or disrupted operations.
The value of a test lies not just in the campaign, but in what you can change based on its results.
Objectives, target groups, scenarios, channels, safe delivery rules and a timeline.
Technical preparation and execution of phishing, smishing, vishing or physical tests.
Relevant responses: clicking through, submitting information, taking an action, reporting and responding correctly.
Results in context, identified weaknesses and specific next steps for management and IT.
In the report, we separate individual scenarios, explain the results and show where a person, process or technical measure failed. It includes specific recommendations for the next steps.
We agree the scope, data collection and evaluation method in advance. The aim is to identify weaknesses and improve behaviour, not create a public ranking of people to blame.
We clarify the objectives, environment, at-risk groups and technical constraints.
We choose suitable channels and prepare a tailored attack pretext.
We define the scope, contact people, escalation rules and necessary exceptions.
We run the test and record the responses agreed in advance.
We deliver the report, explain our findings and recommend the next steps.
A one-off simulation for a selected group, operation or risk, or for verification after training. Suitable as a baseline assessment or a test of a specific process.
A combination of different scenarios throughout the year, comparing results and gradually increasing difficulty as the organisation learns.
Based on the objective, job roles, environment and actual risks. USB baiting may be more valuable in manufacturing, targeted vishing for management, and phishing or smishing linked to financial processes for accounting teams.
Yes. A single scenario can start with an email, continue with a phone call and end on a fraudulent website. We always configure the combination to match the agreed scope.
Only the data needed for the agreed evaluation. We define the scope of measurement, access to results and how they are retained before launching the test.
That depends on the test objective and the organisation's internal rules. Together, we choose an approach that delivers meaningful results while respecting your legal and HR requirements.
We review the results with you and recommend specific changes: training for selected groups, process adjustments, technical measures or a follow-up test with a different scenario.
A phishing simulation is an agreed test that safely assesses how employees respond to fraudulent emails. BOIT also runs telephone simulations (vishing), SMS scenarios (smishing) and physical baiting tests. Deliverables include agreed metrics, a report and recommendations for improvement.