Well many companies tend to neglect their critical infrastructure often you see these things are out of scope, which is fine but an attacker will not care. Now if they have say stated that social engineering methods are out of scope and just find a vulnerability well they kinda are not addressing the current threats. Look at nearly every big breach or significant breaks minus experian, because they just decided to put everything publicly, but social manipulation was a factor. It's not all about vulnerabilities and exploits in an engagement, if clients do not understand that they are doing themselves a disservice, we as security professionals would be doing that client wrong if we don't explain that generally you will have an attacker who doesn't care for your scope and social manipulation is on the table not just exploits and I would and have noted these things on reports when we are being handicapped. Look at the DNC hack 9 emails only 1 employee went ahead and dug the phishing email out of the spam and proceeded to open the attachment, most companies need to understand how APTs work, common techniques and what is being targeted.
I did pretty much vulnerability assessments before, hated it and it is how I came to HF, but also you basically are checking the systems taking out the most exploitable factor.. the human factor. I usually would include a small piece on the importance of proper policies and procedures to mitigate that employee who gets phished/vished/smished/ all the *ished. Remember that probably half the time you see that they are color trained purple/orange or red/orange they focus on but what about logs? I''ve seen a client with public logs for their webapp that dumped what ever shit was in their webapp at the time it crashed.. customer name ssn credit card address everything .. public mind you, that isn't an exploit but sure as shit proves that you are patching but doing stupid shit on the side and an attacker doesn't need an exploit just look at your logs.
