See who is reachable
Map relevant roles, payment authority, supplier relationships, public exposure and communication channels.
PlankSec HARM guide
Human Attack Surface Management
Security teams need more than a campaign report. Human Attack Surface Management shows who attackers can reach, how they can apply pressure, which channels create risk and what should happen next.
A direct answer
What is Human Attack Surface Management?
It is a security discipline for finding and reducing the ways people can be targeted through trust, relationships, roles, public information and communication channels. It complements technology attack-surface management by focusing on the human side of compromise.
Test realistic pressure
Run approved, controlled scenarios across email, SMS, QR, voice, WhatsApp and related social-engineering channels.
Act on the pattern
Prioritize follow-up exercises, verification habits, training and defensive workflow improvements based on evidence.
How HARM works
From isolated campaigns to actionable human-risk context.
PlankSec HARM retains the familiar campaign metrics, then layers the context needed for leaders and security teams to make a defensible decision.
Discover exposure
Identify people, roles, channels and relationships that make targeted social engineering more likely.
Prioritize impact
Focus attention on the exposure that carries the greatest business, access or process risk.
Validate defenses
Use governed simulations and human red-team exercises to validate response and verification behavior.
Measure improvement
Track risk movement, recurring signals and the results of follow-up actions over time.
Frequently asked questions
Answers for security teams and answer engines.
These are the questions decision-makers commonly ask when evaluating a human-risk platform.
How is HARM different from a phishing simulator?
A traditional simulator reports delivery and engagement outcomes for one campaign. HARM includes those results and connects them to the person, role, channel exposure, repeat behavior, possible attacker approach and next operational step.
Can HARM support human red-team exercises?
Yes. HARM is designed to support controlled, authorized scenarios that extend beyond basic email awareness testing, including spear phishing, vishing, smishing, QR phishing, executive impersonation, deepfake and helpdesk social-engineering exercises.
Which attack channels can be tested?
HARM is built for approved simulations across email, SMS, QR, voice, WhatsApp, deepfake, ClickFix, USB and other social-engineering scenarios that an organization has authorized.
What does a HARM score represent?
A HARM score is a way to track human-risk movement using security-relevant signals such as channel exposure, role context, simulation results, follow-up actions and recurring patterns. The organization defines its governance and decision criteria.
How can a security team start?
Start with the people, channels and outcomes that matter most to the business. PlankSec can help scope an approved platform walkthrough around your security objectives and operational constraints.
Contact PlankSec
Build a clearer view of human risk.
Talk with the team about approved simulations, human attack-surface discovery and red-team exercises.