Cybersecurity executives are already conversant in the thought of phishing prevention. For years, CISOs have educated employees to be suspicious of and immune to old-school social engineering assaults, by which attackers use faux emails or texts that appear to come back from executives, managers, distributors, companions or clients. Some organizations use safety consciousness coaching instruments or providers that run simulated phishing assaults to establish weaknesses in coaching supplies and customers who want additional coaching.
With the regular unfold of AI instruments by each a part of the cybercrime market, some social engineering campaigns now embody voice and video, which people are predisposed to belief. Generative AI helps malicious actors craft deepfake phishing assaults, utilizing the cloned voices and artificial photographs of firm executives and even workers’ direct managers or friends.
Phishing simulation instruments are leveling up accordingly, incorporating AI deepfakes to probe organizational resistance to state-of-the-art social engineering throughout a number of channels. With these instruments, safety groups can impersonate executives in deepfake voice or video messages and even converse with employees in actual time on audio or video calls, maybe demanding they alter a password or permission setting or authorize a monetary transaction.
Is deepfake phishing simulation software program value it?
As in all cybersecurity selections, CISOs have to weigh threat and value in deciding whether or not to deploy deepfake-capable phishing simulations.
These sorts of instruments usually come at vital value. A CISO should weigh that value in opposition to the group’s potential losses if a employees member falls sufferer to social engineering, and the chance of that taking place. Think about only one particular person responds to, say, an pressing telephone name purportedly from the CIO with directions to isolate a complete information middle from the remainder of the enterprise. If that may drive losses of tons of of 1000’s or tens of millions of {dollars}, or create existential operational threat, then higher hardening in opposition to social engineering might be justifiable. Different dangers, equivalent to leakage of personally identifiable info or confidential mental property, may also justify the expense.
A CISO ought to issue one other kind of vulnerability into the calculation, too: the provision of uncooked supplies wanted to generate deepfakes. If executives, leaders or subject material consultants within the firm have appeared in public at stay occasions or on podcasts or webinars, and video or audio of these appearances is available on YouTube or the like, then total threat will increase. That CEO’s TED Speak, that CTO’s MWC (previously Cell World Congress) keynote, that CISO’s RSAC convention session — any might be changed into deepfake fodder.
One strategy to gauge the true stage of vulnerability within the group is, in fact, to check utilizing a good deepfake phishing simulation device on a short-term contract. Some distributors even provide trial variations, totally anticipating their choices to efficiently idiot potential clients’ employees and thereby show their worth.
What to search for in deepfake phishing simulation software program
When evaluating deepfake phishing simulation software program, CISOs ought to take into account whether or not choices have the next capabilities:
- Means to create lifelike deepfakes within the platform.
- Means to search materials for deepfakes on public sources, also called open supply intelligence (OSINT).
- Means to make use of real-time voice conversations with a cloned voice as a part of an assault simulation.
- Means to make use of real-time, two-way video with a deepfake picture and cloned voice in a simulation.
- Means to drive multichannel assaults — e.g. utilizing voice calling and SMS, or e mail and video conferencing.
Additionally it is essential to evaluate the device’s integration capabilities with different phishing simulation instruments and phishing coaching packages, in addition to the convenience of operating each broad assault simulations and spear phishing campaigns geared toward particular people.
Moreover, take into account if there’s a studying curve for superior performance. Additionally consider if the device helps all of the languages the corporate makes use of for enterprise and helps all of the compliance regimes the corporate operates below.
Deepfake phishing simulation suppliers
As is typical within the cybersecurity market, deepfake phishing simulation suppliers at the moment embody a contemporary crop of startups targeted sharply on the vanguard of the risk house — on this case, the addition of AI-powered deepfakes — and a smaller set of incumbents. Further safety consciousness coaching incumbents are seemingly determining which startups to merge with or purchase.
The next choices, listed alphabetically, present CISOs with perception into the present deepfake phishing simulation software program market.
Editor’s observe: The creator chosen these instruments based mostly on market analysis, prioritizing choices which have sizable buyer bases, related options and distinguishing traits.
- Adaptive Safety. Creates deepfake video and audio simulations, constructed from public OSINT. Permits multichannel simulated assaults throughout e mail, voice, SMS and chat. Serves many verticals, together with hospitality, healthcare and schooling.
- Breacher.ai. Launches orchestrated, multistage assault chains with coordinated OSINT-based campaigns throughout channels, together with deepfake movies and voice cloning. Adapts in actual time based mostly on the goal’s response, mirroring adversaries’ conduct and stress-testing enterprise defenses.
- Brightside. Offers phone-based social engineering assaults with stay, conversational AI calls that use customized voice cloning. Runs hybrid vishing and e mail phishing campaigns, powered by OSINT.
- Hoxhunt. Helps creation of deepfake audio and video to be used in multichannel simulated assaults. Pre-scripted exchanges are designed to seem actual time — utilizing the pretext of poor connectivity to clarify lagging and glitching results — however do not help open-ended chatting. Makes use of faux, look-alike variations of Zoom, Microsoft Groups and Google Meet apps to include the expertise. A consumer who falls for the deepfake receives on the spot micro-training.
- KnowBe4. Longtime safety consciousness coaching supplier launched its Deepfake Coaching Content material Agent in 2026. Helps audio and video uploads from consenting insiders, equivalent to executives, to generate deepfakes. As of this writing, nevertheless, KnowBe4’s printed documentation doesn’t describe help for real-time, two-way voice conversations, which is the place probably the most novel threats at the moment lie.
As at all times, CISOs ought to assess distributors’ strengths throughout verticals and geographies. Take into account additionally their total monetary stability, particularly if they’re nonetheless venture-funded.
John Burke is CTO and a analysis analyst at Nemertes Analysis. Burke joined Nemertes in 2005 with practically 20 years of know-how expertise. He has labored in any respect ranges of IT, together with as an end-user help specialist, programmer, system administrator, database specialist, community administrator, community architect and methods architect.
