Certified Social Engineering Prevention Specialist (CSEPS) is a social engineering security-awareness training and professional certification program originally developed by Kevin Mitnick and Alexis Kasperavičius.

Course structure

The original CSEPS program was structured as a multi-module corporate security-awareness course designed to teach employees, managers, and IT personnel how social engineers manipulate human behavior to bypass technical security systems.

The curriculum combined case studies, psychological analysis, attack demonstrations, pretexting exercises, and operational security scenarios.

The course materials described social engineering as the exploitation of "the human factor" in information security and argued that traditional technical defenses alone were insufficient to protect organizations from deception-based attacks.

The training program was divided into instructional modules covering topics such as:

• social engineering methodology and threat analysis

• intelligence gathering and reconnaissance

• dumpster diving

• pretexting

• elicitation technique

• telephone-system exploitation and caller-ID spoofing

• psychological influence techniques

• industrial espionage

• identity theft

• organizational vulnerabilities

• security policy development and employee awareness training

The course also analyzed historical and contemporary case studies involving information theft, corporate espionage, fraudulent wire transfers, and telephone-based impersonation attacks.

Training exercises required participants to analyze how attackers established credibility, manipulated trust, overcame objections, and exploited organizational procedures.

According to The Wall Street Journal, CSEPS was delivered as a two-day "boot camp" course costing approximately US$1,500 per attendee. Clients reportedly included the United States Air Force and the United States Marine Corps.

The certification examination included multiple-choice and written-response sections dealing with social-engineering defense scenarios and mitigation strategies.

History

In 2003, Mitnick and Kasperavičius partnered with the Florida-based IT training company Intense School Inc. to offer CSEPS classes throughout the United States.

In 2020, Mitnick partnered with security-awareness training company KnowBe4, and elements of the original CSEPS material became incorporated into KnowBe4's social-engineering awareness training offerings.

References