I think there is a slight tension here between what you can ethically test and what an attacker is likely to do. I've worked for a company where armed forces stormed one of the offices and made the workers perform certain actions at gunpoint. A good security audit should be able to find out which people have unfettered access to systems, and should be able to report on how to prevent that access being abused.
But, as the post says, you can't really simulate blackmailing a staff member into committing a crime.
I'm reminded of this bizarre story about an "active shooter drill" which ended up traumatising staff and getting the "trainer" arrested
But, as the post says, you can't really simulate blackmailing a staff member into committing a crime.
I'm reminded of this bizarre story about an "active shooter drill" which ended up traumatising staff and getting the "trainer" arrested
https://omaha.com/news/local/crime-and-courts/gunman-in-omah...