Cybersecurity executives are already accustomed to the thought of phishing prevention. For years, CISOs have skilled workers to be suspicious of and immune to old-school social engineering assaults, during which attackers use pretend emails or texts that appear to come back from executives, managers, distributors, companions or clients. Some organizations use safety consciousness coaching instruments or providers that run simulated phishing assaults to determine weaknesses in coaching supplies and customers who want additional coaching.
With the regular unfold of AI instruments by way of each a part of the cybercrime market, some social engineering campaigns now embrace voice and video, which people are predisposed to belief. Generative AI helps malicious actors craft deepfake phishing assaults, utilizing the cloned voices and artificial photographs of firm executives and even workers’ direct managers or friends.
Phishing simulation instruments are leveling up accordingly, incorporating AI deepfakes to probe organizational resistance to state-of-the-art social engineering throughout a number of channels. With these instruments, safety groups can impersonate executives in deepfake voice or video messages and even converse with workers in actual time on audio or video calls, maybe demanding they alter a password or permission setting or authorize a monetary transaction.
Is deepfake phishing simulation software program value it?
As in all cybersecurity selections, CISOs must weigh danger and value in deciding whether or not to deploy deepfake-capable phishing simulations.
These sorts of instruments usually come at vital value. A CISO should weigh that value towards the group’s potential losses if a workers member falls sufferer to social engineering, and the probability of that occuring. Think about only one individual responds to, say, an pressing telephone name purportedly from the CIO with directions to isolate a whole information heart from the remainder of the enterprise. If that will drive losses of lots of of hundreds or thousands and thousands of {dollars}, or create existential operational danger, then higher hardening towards social engineering might be justifiable. Different dangers, resembling leakage of personally identifiable info or confidential mental property, may also justify the expense.
A CISO ought to issue one other type of vulnerability into the calculation, too: the supply of uncooked supplies wanted to generate deepfakes. If executives, leaders or material consultants within the firm have appeared in public at dwell occasions or on podcasts or webinars, and video or audio of these appearances is available on YouTube or the like, then total danger will increase. That CEO’s TED Speak, that CTO’s MWC (previously Cellular World Congress) keynote, that CISO’s RSAC convention session — any might be become deepfake fodder.
One option to gauge the true stage of vulnerability within the group is, in fact, to check utilizing a good deepfake phishing simulation instrument on a short-term contract. Some distributors even provide trial variations, absolutely anticipating their choices to efficiently idiot potential clients’ workers and thereby show their worth.
What to search for in deepfake phishing simulation software program
When evaluating deepfake phishing simulation software program, CISOs ought to think about whether or not choices have the next capabilities:
- Capability to create lifelike deepfakes within the platform.
- Capability to search materials for deepfakes on public sources, also called open supply intelligence (OSINT).
- Capability to make use of real-time voice conversations with a cloned voice as a part of an assault simulation.
- Capability to make use of real-time, two-way video with a deepfake picture and cloned voice in a simulation.
- Capability to drive multichannel assaults — e.g. utilizing voice calling and SMS, or electronic mail and video conferencing.
Additionally it is essential to evaluate the instrument’s integration capabilities with different phishing simulation instruments and phishing coaching packages, in addition to the convenience of working each broad assault simulations and spear phishing campaigns aimed toward particular people.
Moreover, think about if there’s a studying curve for superior performance. Additionally consider if the instrument helps all of the languages the corporate makes use of for enterprise and helps all of the compliance regimes the corporate operates underneath.
Deepfake phishing simulation suppliers
As is typical within the cybersecurity market, deepfake phishing simulation suppliers at the moment embrace a recent crop of startups targeted sharply on the vanguard of the risk area — on this case, the addition of AI-powered deepfakes — and a smaller set of incumbents. Further safety consciousness coaching incumbents are seemingly determining which startups to merge with or purchase.
The next choices, listed alphabetically, present CISOs with perception into the present deepfake phishing simulation software program market.
Editor’s word:Â The creator chosen these instruments based mostly on market analysis, prioritizing choices which have sizable buyer bases, related options and distinguishing traits.
- Adaptive Safety. Creates deepfake video and audio simulations, constructed from public OSINT. Allows multichannel simulated assaults throughout electronic mail, voice, SMS and chat. Serves many verticals, together with hospitality, healthcare and schooling.
- Breacher.ai. Launches orchestrated, multistage assault chains with coordinated OSINT-based campaigns throughout channels, together with deepfake movies and voice cloning. Adapts in actual time based mostly on the goal’s response, mirroring adversaries’ conduct and stress-testing enterprise defenses.
- Brightside. Gives phone-based social engineering assaults with dwell, conversational AI calls that use customized voice cloning. Runs hybrid vishing and electronic mail phishing campaigns, powered by OSINT.
- Hoxhunt. Helps creation of deepfake audio and video to be used in multichannel simulated assaults. Pre-scripted exchanges are designed to seem actual time — utilizing the pretext of poor connectivity to clarify lagging and glitching results — however do not help open-ended chatting. Makes use of pretend, look-alike variations of Zoom, Microsoft Groups and Google Meet apps to include the expertise. A consumer who falls for the deepfake receives immediate micro-training.
- KnowBe4. Longtime safety consciousness coaching supplier launched its Deepfake Coaching Content material Agent in 2026. Helps audio and video uploads from consenting insiders, resembling executives, to generate deepfakes. As of this writing, nevertheless, KnowBe4’s printed documentation doesn’t describe help for real-time, two-way voice conversations, which is the place essentially the most novel threats at the moment lie.
As all the time, CISOs ought to assess distributors’ strengths throughout verticals and geographies. Contemplate additionally their total monetary stability, particularly if they’re nonetheless venture-funded.
John Burke is CTO and a analysis analyst at Nemertes Analysis. Burke joined Nemertes in 2005 with almost 20 years of know-how expertise. He has labored in any respect ranges of IT, together with as an end-user help specialist, programmer, system administrator, database specialist, community administrator, community architect and methods architect.
