A familiar request.
A supplier document, password reset or executive instruction arrives in the channel employees use all day.
Human Attack & Risk Management
Who can reach
Who can reach
your people?
PlankSec HARM helps security teams see, test and reduce the human attack surface across email, WhatsApp, SMS, QR, voice, deepfake, ClickFix, USB and social engineering.
Multi-channel human risk intelligence. Platform currently in active development.
HARM Score72
Open Risk Signals156
The problem
Attackers don't
Attackers don't
stay in the inbox.
Your people can be reached through many paths. The channel changes; the target is still human trust.
SC
Sarah Chen
Finance Director
A trusted identity.
An attacker changes the channel and uses urgency, familiarity and a public relationship to make the request feel real.
Pressure in real time.
Vishing removes the pause people get with email. Verification habits are tested while a caller controls the pace.
Recognition is no longer proof.
Synthetic voice or video can amplify executive impersonation and exploit established trust.
The path can leave the screen.
USB drops and blended social engineering test curiosity, process and physical handling behavior.
A new security category
Your people are
Your people are
an attack surface.
Attack surface management protects the technology attackers can reach. HARM focuses on the people attackers can reach.
Traditional attack surface
Technology
- Applications
- Cloud
- Domains
- Servers
- Endpoints
- APIs
Human attack surface
People
- Employees
- Roles
- Relationships
- Communication channels
- Public exposure
- Behavior
- Trust
One operational view
See human risk forming.
Signals become useful when security teams can see the people, channels and outcomes behind them.
Find the exposure before the attack.
Map the role, relationships, public signals and channels that make a person reachable.
Test how attackers actually reach people.
Choose an approved channel and scenario that reflects the pressure the role may face.
See what happens under pressure.
Capture security-relevant outcomes without turning human risk into productivity surveillance.
Turn behavior into risk intelligence.
Connect channel outcomes with role criticality, history, training and exposure.
Know what to do next.
Target training, verify the improvement and keep the analyst in control of every action.
Human exposure profileHigh potential
SCFinance
Sarah Chen
Finance Director
High-value financial rolePayment authority and supplier access
Public phone number exposedFound on a professional profile
Executive relationship identifiedFrequently associated with CFO
Vendor payment responsibilityHigh-impact operational trust
Potential Human Attack SurfaceHigh
Simulation setupPreview only
VO
Selected scenario
CEO urgent supplier payment
Verification pressure and executive impersonation
- Target
- Sarah Chen
- Role
- Finance Director
- Channel
- Voice
- Difficulty
- Medium
No message or call is sent from this website preview.
Behavior historyLast 90 days
Email phishingReported
ProtectedWhatsApp impersonationIgnored
ProtectedQR simulationScanned
MediumVishingSensitive information disclosed
HighClickFixNo execution
ProtectedTrainingIncomplete
ActionHARM Score72/ 100
Email61WhatsApp48Voice84Deepfake73QR57USB22
Role CriticalitySimulation HistorySocial ExposureTraining StatusBehavioral Signals
Recommended actionsScout reviewed
01
Callback verification trainingTarget the seven users who disclosed information
02
Follow-up vishing simulationVerify improvement after training
03
Manager insightShare the Finance pattern without exposing private content
Current72
toProjected after action58
Inside HARM
Meet Scout.
Your AI helper for human risk operations.
Scout assists analysts with campaign setup, scenario selection, result summaries and recommended follow-up work. It prepares the work; the user reviews and approves it.
- Create campaign drafts
- Recommend target groups
- Explain HARM Score changes
- Summarize campaign results
- Suggest training and follow-up tests
Scout AIOnline inside HARM
A phishing simulator reports campaign activity.
HARM explains human attack exposure.
Campaign outcomes
Useful for one campaign report, but shallow when leadership needs to understand where human risk is forming.
- SentDelivery count
- OpenedEngagement count
- ClickedFailure count
- ReportedReporter count
- Training completedCompletion count
Human risk command context
HARM includes everything a traditional simulator reports, then connects each result to the person, role, channel, pattern and next action needed to reduce real human risk.
- Everything traditional systems reportSent, opened, clicked, reported and completed
- Who is exposedPerson and group risk
- How attackers can reach themEmail, voice, SMS, WhatsApp, QR and more
- Which channels create riskChannel exposure breakdown
- How role affects impactBusiness context and blast radius
- What patterns are emergingBehavior trends and repeat signals
- What should happen nextScout recommendations and workflows
- Whether risk is improvingHARM score movement over time
- Where an adversary could apply pressureRole-led scenarios and attack paths
- How teams should validate defensesControlled human red-team exercises
From awareness testing to human red teaming
Move beyond isolated email tests with controlled, approved scenarios that model how attackers combine reconnaissance, impersonation, channels and operational pressure.
Spear phishingVishingSmishingQR phishingWhatsAppExecutive impersonationDeepfake scenariosHelpdesk social engineeringMulti-stage attacks
Attack channel explorer
Test the paths attackers use.
Email phishing and spear-phishing scenarios that test credential, attachment, payment and account-access decisions.
Email / available in preview
Platform previewOne platform.
One platform.
Every human risk signal.
The interface follows one operating model across campaigns, people, profiles and integrations.
Privacy by design
Human risk without human surveillance.
HARM is designed around configured simulations, exposure and security-relevant outcomes. It is not positioned as productivity monitoring or silent access to private employee content.
Role-based access
Limit views and actions to the teams responsible for human-risk operations.
Data minimization
Collect the signals needed for security decisions, not unrelated personal activity.
Audit visibility
Keep campaign ownership, approvals and operational actions reviewable.
Configurable retention
Align simulation records and reporting windows with organizational policy.
Secure storage
Protect lead and platform data with controlled access and encrypted transport.
Privacy-aware reporting
Give leaders useful patterns without exposing unnecessary private content.
Private platform walkthroughKnow your
Know your
human attack surface.
See where your people are exposed. Test how attackers can reach them. Measure what happens. Reduce the risk before it becomes an incident.
Request a walkthrough
Tell us what you need to test.
We will focus the conversation on your channels, teams and human-risk goals.