Multi-call sequences explained

What a multi-call sequence is, the phases each call plays, how the caller remembers between calls, and the 21 built-in sequences you can run.

A sequence is a scheduled series of calls to the same person, days apart. The console puts it this way: “Real attackers do not make one call. They make several, each building on the last.” The first calls are friendly and gather small facts. The last call makes the real ask, when it is finally believable.

You find them under Red Team, Campaigns, then Browse the sequence library. The page is titled Attack sequences.

​

How a sequence works

What the console says	What it means
It calls more than once	A scheduled series of calls to the same person, days apart, not a single cold call.
It remembers each call	After every call the caller writes what it learned into a running dossier. The next call is briefed with all of it, so the persona never starts over and never contradicts itself.
It only asks when ready	The friendly early calls build trust and gather facts. The real ask comes last.

A step is a call by default. One built-in sequence starts with a text message instead. A text step sends the message and moves straight on to the next step. There is nothing to wait for.

​

The phases

Each call has a job. The plan on a sequence page labels every step with one of these phases.

Phase	What the call does
Recon	A harmless check-in that gathers context: a manager’s name, a portal name, a process. Nothing sensitive is asked for.
Elicitation	Draws out facts under a flattering or routine pretext, for example a recruiter asking about tools and access.
Rapport	Banks a small commitment, such as “can I count on you for a 30-second check at rollout?”
Exploitation	The real ask. This is the call that is scored as passed or failed.
Exit	A closing step. It is defined, but none of the built-in sequences use it.

​

The 21 built-in sequences

Each is modelled on a documented real attack. The sequence page names it under Modelled on a real attack. The scripts are not reproduced here. Open a sequence and click See how it works to read each call’s job and teaching point.

Name	Area	Level	Steps	Phases	Spread over	What the last call tests
The Okta Migration	IT	hard	3 calls	Recon, Rapport, Exploitation	3 days	Whether the person reads back a one-time code under authority, urgency and a prior commitment
The Help-Desk Reset	IT	hard	3 calls	Recon, Rapport, Exploitation	3 days	Whether the help desk resets a password and moves MFA to a new device without independent checks
Approve The Prompt	IT	medium	2 calls	Elicitation, Exploitation	1 day	Whether the person approves an unexpected MFA push “to stop the alerts”
The VPN Outage	IT	medium	2 calls	Recon, Exploitation	2 days	Whether the person reads back an MFA code or approves a prompt to “restore” VPN access
Identity Portal Update	IT	easy	2 calls	Recon, Exploitation	1 day	Whether the person reads back a live 2FA code to “confirm” a routine update
The Remittance Update	Finance	medium	3 calls	Recon, Rapport, Exploitation	4 days	Whether accounts payable redirects a payment to a new account without checking out of band
The Confidential Acquisition	Finance	hard	2 calls	Recon, Exploitation	1 day	Whether a finance staffer makes an urgent secret transfer on one caller’s say-so
Move To A Safe Account	Finance	medium	2 calls	Recon, Exploitation	1 day	Whether finance moves funds to a “safe account” on the caller’s instruction
The Corrected Invoice	Finance	medium	2 calls	Recon, Exploitation	3 days	Whether accounts payable pays a reissued invoice to a new account without checking the supplier record
Direct Deposit Change	HR	easy	2 calls	Recon, Exploitation	1 day	Whether payroll changes bank details by phone without verifying the employee
The Dream Job	HR	medium	2 calls	Elicitation, Elicitation	1 week	Whether the person gives away projects and access level to a “recruiter”
The W-2 Request	HR	medium	2 calls	Recon, Exploitation	2 days	Whether payroll releases bulk staff data on an urgent “executive” request
The New Starter	HR	medium	3 calls	Recon, Rapport, Exploitation	3 days	Whether onboarding issues early credentials or MFA enrolment without proper checks
The Fictitious Pickup	Logistics	medium	2 calls	Recon, Exploitation	2 days	Whether the coordinator releases pickup credentials without verifying the carrier and driver
The Delivery Driver	Logistics	easy	2 calls	Recon, Exploitation	1 day	Whether the person lets a “driver” in without verifying the delivery
The Carrier Update	Logistics	medium	2 calls	Recon, Exploitation	4 days	Whether the admin changes a carrier’s contact and bank details without verification
The Reroute Request	Logistics	hard	3 calls	Recon, Rapport, Exploitation	2 days	Whether dispatch diverts a high-value shipment to a new address without authorised checks
The Gift Card Errand	Executive	easy	2 calls	Recon, Exploitation	1 day	Whether an assistant buys gift cards and reads back the codes
The Parent-Company CEO	Executive	hard	2 calls	Recon, Exploitation	1 day	Whether an executive makes an urgent transfer on a cloned voice alone
The Book Recommendation	Executive	hard	3 calls	Recon, Elicitation, Exploitation	1 week	Whether the executive acts on an urgent confidential instruction without a challenge question
Text Then Call	IT	medium	1 text, then 1 call	Elicitation (text), Exploitation (voice)	1 day	Whether the person reads back a code on a call that a text message made feel expected

The spread is the designed pace. On a campaign you can set your own gap between calls, or switch on Demo mode to run the whole chain in minutes. See Run a multi-call sequence.

​

Your own library

You can keep a copy of any built-in sequence under your own name. Open it, click Save to my library, give it a Name and an optional Description, then click Save. Saved copies appear under Your library at the top of the Attack sequences page, each with Launch and a delete icon. Deleting a saved copy cannot be undone.

​

Safe by design

A sequence is a simulation. A “success” means the person would have disclosed; it is scored, never acted on. The caller is told on every call to stay polite, never threaten, and stop the moment the person refuses, hangs up or asks to verify through an official channel.

Run a multi-call sequence

Pick a sequence, set the timing, and launch.

Read your results

A sequence shows one row per call, not per person.

Fair testing rules

Later calls of one sequence are never spaced out by the cooling-off rule.