Does anybody have advice on how to deal with social engineering in the context of writing up a penetration test report?

How do you assign a rating to social engineering? Obviously if you can convince a user with admin access to modify or delete a file, or to shut down a server, then it's a high risk. Is there a standard like the CVSS (https://nvd.nist.gov/CVSS-v2-Calculator) that should be used to rate it?

1 Answer 1


I'm not sure that I would rate it at all. Rating requires that you can define the limits and boundaries of the risk. The potential for every social engineering attack is extremely high.

If you successfully performed a social engineering attack, then I would simply list the event and the extent of the effect you had.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .