madedee - stock.adobe.com
What to know about deepfake phishing simulation software
Deepfake phishing simulation software uses AI to probe organizational resistance to state-of-the-art social engineering attacks. Learn why they should be on CISOs' radar.
Cybersecurity executives are already familiar with the idea of phishing prevention. For years, CISOs have trained staff to be suspicious of and resistant to old-school social engineering attacks, in which attackers use fake emails or texts that seem to come from executives, managers, vendors, partners or customers. Some organizations use security awareness training tools or services that run simulated phishing attacks to identify weaknesses in training materials and users who need further training.
With the steady spread of AI tools through every part of the cybercrime marketplace, some social engineering campaigns now include voice and video, which humans are predisposed to trust. Generative AI helps malicious actors craft deepfake phishing attacks, using the cloned voices and synthetic images of company executives or even employees' direct managers or peers.
Phishing simulation tools are leveling up accordingly, incorporating AI deepfakes to probe organizational resistance to state-of-the-art social engineering across multiple channels. With these tools, security teams can impersonate executives in deepfake voice or video messages or even converse with staff in real time on audio or video calls, perhaps demanding they change a password or permission setting or authorize a financial transaction.
Is deepfake phishing simulation software worth it?
As in all cybersecurity decisions, CISOs need to weigh risk and cost in deciding whether to deploy deepfake-capable phishing simulations.
These kinds of tools typically come at significant cost. A CISO must weigh that cost against the organization's potential losses if a staff member falls victim to social engineering, and the likelihood of that happening. Imagine just one person responds to, say, an urgent phone call purportedly from the CIO with instructions to isolate an entire data center from the rest of the enterprise. If that would drive losses of hundreds of thousands or millions of dollars, or create existential operational risk, then better hardening against social engineering is probably justifiable. Other risks, such as leakage of personally identifiable information or confidential intellectual property, might also justify the expense.
A CISO should factor another sort of vulnerability into the calculation, too: the availability of raw materials needed to generate deepfakes. If executives, leaders or subject matter experts in the company have appeared in public at live events or on podcasts or webinars, and video or audio of those appearances is readily available on YouTube or the like, then overall risk increases. That CEO's TED Talk, that CTO's MWC (formerly Mobile World Congress) keynote, that CISO's RSAC conference session -- any could be turned into deepfake fodder.
One way to gauge the true level of vulnerability in the organization is, of course, to test using a reputable deepfake phishing simulation tool on a short-term contract. Some vendors even offer trial versions, fully expecting their offerings to successfully fool prospective customers' staff and thereby prove their value.
Deepfake phishing simulations: Metrics beyond clicks
Just by identifying which kinds of attacks get an employee to do the wrong thing -- click a link, change a setting, whatever -- phishing simulation tools identify where training needs improvement, processes need tightening and staff -- both individually and by department or role -- need more training.
These tools might also offer additional insights, such as how many users who avoided the phishing attempt also reported it and how long it took them to do so. The more data cybersecurity teams have, the more targeted and meaningful their proactive efforts in training and in process and behavioral hardening can be.
With deepfakes, new levels of testing and reporting are possible. Are staff more susceptible to pleas or threats? To emergencies or tedium? How much does tone of voice change response rates? What about the gender and appearance of the faked person? CISOs, equipped with all kinds of additional data about what their users are susceptible to, can tailor training and hardening initiatives accordingly.
What to look for in deepfake phishing simulation software
When evaluating deepfake phishing simulation software, CISOs should consider whether offerings have the following capabilities:
- Ability to create realistic deepfakes in the platform.
- Ability to seek material for deepfakes on public sources, also known as open source intelligence (OSINT).
- Ability to use real-time voice conversations with a cloned voice as part of an attack simulation.
- Ability to use real-time, two-way video with a deepfake image and cloned voice in a simulation.
- Ability to drive multichannel attacks -- e.g. using voice calling and SMS, or email and video conferencing.
It is also important to assess the tool's integration capabilities with other phishing simulation tools and phishing training packages, as well as the ease of running both broad attack simulations and spear phishing campaigns aimed at specific individuals.
Additionally, consider if there is a learning curve for advanced functionality. Also evaluate if the tool supports all the languages the company uses for business and supports all the compliance regimes the company operates under.
Deepfake phishing simulation providers
As is typical in the cybersecurity market, deepfake phishing simulation providers currently include a fresh crop of startups focused sharply on the leading edge of the threat space -- in this case, the addition of AI-powered deepfakes -- and a smaller set of incumbents. Additional security awareness training incumbents are likely figuring out which startups to merge with or acquire.
The following offerings, listed alphabetically, provide CISOs with insight into the current deepfake phishing simulation software market.
Editor's note: The author selected these tools based on market research, prioritizing offerings that have sizable customer bases, relevant features and distinguishing characteristics.
- Adaptive Security. Creates deepfake video and audio simulations, built from public OSINT. Enables multichannel simulated attacks across email, voice, SMS and chat. Serves many verticals, including hospitality, healthcare and education.
- Breacher.ai. Launches orchestrated, multistage attack chains with coordinated OSINT-based campaigns across channels, including deepfake videos and voice cloning. Adapts in real time based on the target's response, mirroring adversaries' behavior and stress-testing enterprise defenses.
- Brightside. Provides phone-based social engineering attacks with live, conversational AI calls that use custom voice cloning. Runs hybrid vishing and email phishing campaigns, powered by OSINT.
- Hoxhunt. Supports creation of deepfake audio and video for use in multichannel simulated attacks. Pre-scripted exchanges are designed to appear real time -- using the pretext of poor connectivity to explain lagging and glitching effects -- but don't support open-ended chatting. Uses fake, look-alike versions of Zoom, Microsoft Teams and Google Meet apps to contain the experience. A user who falls for the deepfake receives instant micro-training.
- KnowBe4. Longtime security awareness training provider introduced its Deepfake Training Content Agent in 2026. Supports audio and video uploads from consenting insiders, such as executives, to generate deepfakes. As of this writing, however, KnowBe4's published documentation does not describe support for real-time, two-way voice conversations, which is where the most novel threats currently lie.
As always, CISOs should assess vendors' strengths across verticals and geographies. Consider also their overall financial stability, especially if they are still venture-funded.
John Burke is CTO and a research analyst at Nemertes Research. Burke joined Nemertes in 2005 with nearly two decades of technology experience. He has worked at all levels of IT, including as an end-user support specialist, programmer, system administrator, database specialist, network administrator, network architect and systems architect.
