mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
57 lines
1.9 KiB
Markdown
57 lines
1.9 KiB
Markdown
# Vishing Assessment Report Template
|
|
|
|
## Engagement Details
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Campaign ID | VISH-YYYY-XXX |
|
|
| Client | [Organization] |
|
|
| Period | YYYY-MM-DD to YYYY-MM-DD |
|
|
| Total Targets | XX employees |
|
|
| Pretext(s) Used | [List of pretexts] |
|
|
| Assessor | [Name] |
|
|
|
|
## Executive Summary
|
|
|
|
[Organization] engaged [Company] to conduct a vishing assessment targeting XX employees across XX departments. The assessment measured employee susceptibility to social engineering pretext calls, specifically testing credential disclosure, verification procedures, and incident reporting behaviors.
|
|
|
|
## Results Summary
|
|
|
|
| Metric | Result | Benchmark | Status |
|
|
|---|---|---|---|
|
|
| Credential Disclosure Rate | XX% | <10% | Pass/Fail |
|
|
| Sensitive Info Disclosure Rate | XX% | <20% | Pass/Fail |
|
|
| Caller Verification Rate | XX% | >80% | Pass/Fail |
|
|
| Security Reporting Rate | XX% | >50% | Pass/Fail |
|
|
|
|
## Call Log
|
|
|
|
| # | Target | Dept | Pretext | Cred Disclosed | Verified | Reported |
|
|
|---|---|---|---|---|---|---|
|
|
| 1 | [Name] | [Dept] | [Pretext] | Yes/No | Yes/No | Yes/No |
|
|
| 2 | [Name] | [Dept] | [Pretext] | Yes/No | Yes/No | Yes/No |
|
|
|
|
## Department Risk Scores
|
|
|
|
| Department | Targets | Disclosure Rate | Risk Level |
|
|
|---|---|---|---|
|
|
| Finance | XX | XX% | Critical/High/Medium/Low |
|
|
| HR | XX | XX% | Critical/High/Medium/Low |
|
|
| IT | XX | XX% | Critical/High/Medium/Low |
|
|
|
|
## Recommendations
|
|
|
|
### Immediate (0-30 days)
|
|
1. Implement mandatory callback verification for credential requests
|
|
2. Issue security bulletin about vishing threats
|
|
|
|
### Short-Term (30-90 days)
|
|
1. Deploy role-based security awareness training
|
|
2. Establish easy suspicious-call reporting mechanism
|
|
3. Conduct targeted training for high-risk departments
|
|
|
|
### Long-Term (90+ days)
|
|
1. Implement quarterly vishing simulations
|
|
2. Integrate vishing metrics into security KPIs
|
|
3. Develop department-specific verification procedures
|