Multi-vector engagements create coordination problems that single-vector work does not. When you have a phishing operation and a physical social engineering operation running simultaneously against the same target, the two teams are not operating independently. Their actions can create and destroy opportunities for each other in real time. That interdependency is part of what makes these engagements interesting and part of what makes them demanding.
On this engagement, I was running the phishing component remotely while a separate team was on-site at a large enterprise client conducting physical social engineering. The operation had been planned in advance, but physical SE rarely goes according to plan in every detail. You get into a building or you do not, doors that are supposed to be unlocked are locked, the target employee you were expecting to encounter is not there, and the team on-site has to adapt in the moment.
They adapted. And they needed my help.
The call came after hours. My colleagues were inside the target facility and had reached a point in their access attempt where a targeted email (sent from a lookalike domain we had set up for the engagement) would materially improve their odds of deepening their access. They needed it immediately. Not in the morning. Not after I had gotten back to a proper desk setup. Now.
I was sitting in my car.
I got my laptop out, opened it on the steering wheel, and put the email together. The lookalike domain was already configured and operational, so the infrastructure side was not the constraint. The constraint was time and context. A good spear-phishing email requires knowing enough about the target to make it plausible, and I had to work from the information my colleagues were feeding me over the phone about what they had observed on-site. I wrote the email, checked it, and sent it.
They got in.
The debrief afterward was interesting. The email had arrived at a moment when the target was already in a state of uncertainty about the situation. My colleagues on the ground had created that uncertainty deliberately, and the email landing at that exact moment reinforced the scenario they had constructed. The timing mattered as much as the content.
What I think about when I look back on this story is the coordination piece. The engagement worked not because any individual component was particularly sophisticated, but because two separate teams were communicating well enough in real time to create a compound effect. The physical team knew I was available. I was actually available. The infrastructure was ready to be used. None of those things happen automatically. They are the result of planning, communication norms established before the engagement began, and people who are willing to pull their laptop out in a parking lot when the moment requires it.
That last part is not something you can plan. It is just a disposition.