Which tool is an open-source framework widely used for conducting social engineering simulations in security testing?

• A. OhPhish
• B. Social-Engineer Toolkit (SET)
• C. Gap Analysis
• D. Insider Risk Controls

Answer: (B)

For social engineering simulations in security testing, testers rely on a framework that is built specifically for crafting and delivering deceptive campaigns. The Social-Engineer Toolkit is the best fit because it’s a widely adopted open-source framework purpose-built for these engagements. It streamlines the creation of phishing campaigns, cloning of login pages to harvest credentials, and delivery of payloads, all within a single toolkit. Its design centers on enabling realistic social engineering scenarios while giving testers control and repeatability, which is why it’s a go-to choice in professional assessments and training environments.

Other options don’t fit as well. OhPhish isn’t the established, comprehensive framework used for broad social engineering testing. Gap Analysis is a method for comparing current versus desired states and isn’t a tool for running social-engineering simulations. Insider Risk Controls focuses on policies and measures to mitigate insider threats rather than providing a framework to execute social engineering exercises.