One process. Attacked end to end.
Scored where there is evidence.
A Hold The Wire drill tests the money-movement process: the vendor bank change, the payment release, the callback and the escalation. It runs on fixed playbooks, under signed rules of engagement, and stops before anything moves.
Pick a playbook. See the beats.
Every drill runs from a fixed playbook, AI-drafted and operator-approved. Green beats are where your controls get a chance. Red is the stop point.
The drill ends when money would have left.
No payment rails are touched. A one-click sponsor event logger timestamps each stage; an optional read-only vendor-master audit-log export confirms it.
Bank details entered
The new account is keyed into the vendor master. The sponsor reverses it within the window; the timestamp is the finding.
Payment released for approval
The payment reaches the approval queue on the changed details. The approver is the next control, and it is scored.
Callback skipped or misdirected
The "verification" call went to the number the requester supplied, or nowhere. That is the most common failure we plan to test for.
Email blocked by your filter is scored as a control that passed. We do not ask you to weaken your defenses so the drill can "work"; the allowlisting runbook only covers delivery for scoped test domains.
Twelve controls, labeled honestly.
Six are observed in the drill. Six are evidenced by you, through an annual upload questionnaire. We never present an attested control as a tested one. Click a control for what we look for.
Observed in drill
Evidenced by client
Built for the buyer's legal position.
Debrief in 48 hours
With the CFO: timeline, time to detect, failure point, fix list. Plus an HR welfare-debrief template for targeted staff. Never used for discipline.
Drill Results Statement
Point-in-time. "A test, not a warranty." No third-party reliance. Signed by the company. Findings can route through your counsel if you choose (privilege is not guaranteed).
Remediated and Retested
Issued only after a passing retest. Renewals are timed to your insurance renewal where possible, so the result is fresh for the application.
Real tactics, only under written authorization.
We use the techniques a real wire-fraud crew would use, including caller-ID simulation, so your team is tested against the actual attack. Every technique is named in the rules of engagement, explained to the board or the executives who hired us, and signed off before it runs. Any tactic we would otherwise avoid is unlocked only by that written approval.
What we can do, once authorized
- Caller-ID simulation of your own numbers (CEO, CFO, HQ line) when you authorize them in the rules of engagement and verify them with our telephony provider.
- Impersonation of a specific vendor's number only with that vendor's written consent; otherwise a lookalike number, which is what real crews use.
- Executive voice cloning with a written, BIPA-grade release and a sample recorded at consent.
- Long-term social engineering across an annual engagement: multi-touch pretexts built over weeks, each phase pre-approved by the sponsor.
- Combined physical penetration testing (pretext site visits, badge tailgating, dropped devices) as a premium add-on, under a separate signed SOW, through our affiliated physical-pentest team. See pricing.
- Call recording where counsel has approved it in writing for that state; otherwise structured transcripts only.
What we will not do
- Nothing outside the signed rules of engagement, the authorized window, or the named targets.
- No technique that was not explained to and approved by the client's board or authorizing executives.
- No impersonation of a vendor or person who has not consented, beyond a generic lookalike.
- No credential capture, malware, or system intrusion. No funds move and no payment rails are touched.
- No contact with family members or personal accounts. Results describe the process, never used for discipline.
See the scorecard come out of a drill.
Play the sample drill, then carry the result straight into the 12-control scorecard and export the board PDF.