A mid-sized Dutch municipality found that employees were regularly sharing confidential information over the phone. After an initial assessment by DeepCalls, only 35% of the test calls turned out to be handled correctly.
The starting point
Employees were aware of digital threats, but they had not been trained to recognise telephone-based social engineering. Verification procedures existed on paper, but were rarely followed in practice.
The approach
DeepCalls carried out a series of realistic voice phishing simulations, followed by a detailed process analysis. Based on the findings, verification procedures were tightened and employees were trained.
The result
During the follow-up assessment six months later, the percentage of correctly handled calls had risen to 78% — more than double. The municipality has since incorporated structural assessments into its security policy.
