// GLOSSARY

Social Engineering Simulation

A program-level assessment of the human layer; the detect-and-report reflex, time-to-report, correct-escalation percentage and process friction are reduced to an evidence package. The question it asks parts radically from the traditional approach in this area. The classic 'phishing drill' asks 'who was fooled', counts those who clicked and often turns into a tool of shaming or punishment; this approach produces a number but builds no capability, and can even weaken the defense by pushing employees to avoid reporting. The social-engineering simulation instead asks 'does the organization raise the alarm, or does it quietly let them in'. This shifts the center of measurement from the individual's failure to the organization's reflex; because in a large enough organization someone being fooled is inevitable, and what saves it is how fast that moment turns into an alarm. So the frame is deliberately reflex-building, not blaming; the aim is not to catch an employee but to turn the human layer into an early-warning system. It is the canonical name of PT-4, and its primary evidence object is the detect-and-report reflex; voice channels such as vishing are treated as a separate entry surface.