Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change your bank. But it might not be as practical if company X is your university/college/school or government.
Let's say you are not willing/able to change to another service provider, and you don't want them to be sharing your information with the rest of the world. What do you do? It's hard to call the company and tell it that it needs to do a full pen test. They have a tendency of getting defensive in a situation like this.
So my question is how do you tell/prove to a company that its security is weak and they need to do something about it to stay within the bounds of the law? (I think this mostly applies to larger company/organizations so please focus your answers towards them.)
After all impersonation and most on line security testing is illegal. After all if your name is robert') DROP TABLE students;-- then it's just a question of time until you accidentally find something. :)
How do you address social engineering and/or software weakness/concerns in a company or organisation?