Anatomy of an Authorized Phishing Campaign

This describes authorized, scoped security testing only. Phishing without explicit written authorization is illegal.

The technical exploits get the attention, but in a lot of engagements the fastest path in is a convincing email. A good authorized phishing campaign is less about a clever payload and more about discipline and realism.

Scoping comes first

Before anything is sent, the rules are agreed in writing: which addresses are in scope, what the payloads may do, how captured data is handled, and a kill-switch contact. Skipping this is not “moving fast” — it is operating without authorization.

Reconnaissance

Open-source intelligence shapes the pretext. Public org charts, conference talks, job postings and naming conventions tell you who talks to whom and what a normal internal message looks like. The goal is a message indistinguishable from routine traffic.

Building the lure

Credibility beats cleverness:

• A pretext that matches a real, expected workflow.
• Sender and domain details that survive a quick glance.
• A landing experience consistent with what the target expects to see.

Measuring, not just catching

The value to the client is data, not a trophy. Useful metrics:

• Click-through and credential-submission rates.
• Time-to-report (how fast someone alerts the security team).
• Whether technical controls fired as designed.

A high report rate is a win — it means the security culture works.

Why this matters

People are part of the attack surface. Testing them honestly, with consent and care, tells an organization more about its real resilience than another scanner report ever will.