Does anybody have advice on how to deal with social engineering in the context of writing up a penetration test report?
How do you assign a rating to social engineering? Obviously if you can convince a user with admin access to modify or delete a file, or to shut down a server, then it's a high risk. Is there a standard like the CVSS (https://nvd.nist.gov/CVSS-v2-Calculator) that should be used to rate it?