Conversational AI Vishing Simulation
Reduce voice phishing risk across your organisation.
Simulate the call, measure what employees do, and give them a report button.
Overview
Employees engage with a phone simulation about 40% more often than an email one (Verizon 2026 Data Breach Investigations Report, p. 50). A vishing simulation is the exercise that measures it: employees receive simulated voice phishing calls, and you see who gives information away and who reports the call.
How Keepnet Vishing Simulation Works?
Use an existing realistic call phishing scenario or create one that mimics real-world attacks. Assess employees' awareness against vishing scams to identify vulnerability levels.
Deploy realistic voice phishing calls to employees, evaluating their ability to recognize and respond to potential vishing scams.
Monitor employee responses during vishing simulation and deliver instant feedback, highlighting strengths and areas for improvement.
Provide targeted security awareness training based on employees' incorrect actions and behaviors during the vishing simulations.
That 6.5% of employees have given away sensitive information to fake vishing calls?
Keepnet 2024 Vishing Research Report revealed that 70% of organizations have been victims of fake phone calls (vishing). Vishing attacks cost an average of $14 million per year per organization.
Companies that add regular vishing simulations to security awareness training program have the lowest vishing risk, with up to 90% success.
AI-Powered Technology STOP Vishing Attacks
The benefits of using the Keepnet Vishing Simulation include the following:
Launch a campaign within 5 minutes and witness immediate results, empowering your team to swiftly detect and respond to voice phishing attacks.
By building a cybersecurity culture within your organisation, you'll see an average 78% increase in your employees' incident reporting.
By helping organizations avoid costly fines and legal action by ensuring compliance with privacy regulations.
2024 Voice Phishing (Vishing) Simulation Response Report
Key Features of Vishing Simulation
Test and train employees with 5,400+ voice phishing examples that mimic real-world attacks.
How Do You Measure a Drop in Vishing Susceptibility?
The number that matters is susceptibility, meaning the share of employees who give away information or follow instructions during a simulated call. Your first campaign is the baseline. Every campaign after that is measured against it, which turns a training budget into a trend line you can show leadership.
Four numbers move together in a program that works. Susceptibility rate, the share who fall for the call. Reporting rate, the share who flag it afterwards. Time to report, how long the security team waits for the first warning. Repeat exposure, the people who fail more than once and need targeted follow up. Keepnet reports all of these, assigns a human risk score per employee, and compares your result against an industry benchmark so you can see whether you are ahead of your sector or behind it.
Voice is where most programs are blind. The median click rate in email simulations sits near 1.4%, while phone centric simulations fail at roughly 40% higher rates (Verizon 2026 Data Breach Investigations Report, p. 50), and pretexting, which is the tactic behind most vishing calls, was the initial access step in 6% of breaches (p. 10 to 12). An email only program never measures this channel, so the risk stays invisible rather than absent.
How Does Two-Way AI Voice Simulation Work?
Most voice phishing tests play a recording. A Keepnet vishing simulation holds a conversation. The AI caller reacts to what the employee actually says, so the call moves the way a real attacker moves it. It opens with a reason for calling, builds credibility, applies time pressure, and then makes the request. When someone hesitates or asks a question, the call adapts instead of ending.
Every call is recorded and transcribed, and the platform analyses the interaction afterwards. The report lays the call out stage by stage on a timeline, so a security team can see the exact moment an employee complied, pushed back, or refused, and how long the caller kept them on the line. Each call closes by telling the recipient it was a simulation, which keeps the exercise a training moment rather than a trap.
Scenarios come from a template library. Security teams can write their own or have the platform generate one from a short brief, and templates carry a difficulty rating based on how complex the story is, how persuasive the voice is, and how much the request asks for. Calls run in multiple languages.
Keepnet does not spoof caller identity. Simulations run on A2P 10DLC compliant numbers, which keeps the exercise inside telecom regulations while still testing how people respond to pressure on a live call.
What a Vishing Simulation Actually Looks Like
A working voice simulation is not a checkbox on a feature list, so here is the whole run. You pick a scenario from 5,400+ voice phishing templates or write your own, in any of 77 languages. The call is generated with AI text to speech, or you record your own voice for a campaign that has to sound like a specific person, for example an internal IT desk or a known supplier.
Calls go out from your own local phone numbers, so the employee sees a number that looks normal in their country instead of an obvious foreign line. You schedule delivery across specific days and hours, which stops the whole company from comparing notes in the same ten minutes and keeps the test honest. Merge tags personalize the script per employee.
What the employee experiences is a call that asks for something a real attacker would ask for. What happens next is measured: whether they gave it up, whether they hung up, whether they reported it. Feedback is immediate, and targeted training is assigned automatically to the people who need it, not to everyone. A campaign can be live in about five minutes.
If you are comparing channels before you choose, our guide to vishing, phishing and smishing sets them side by side, and SMS phishing simulation runs on the same platform.
Can You Simulate a Help Desk Passkey Enrolment Call?
Yes, and it is the scenario worth running first. Google Threat Intelligence Group reported in August 2026 that the UNC6671 extortion cluster begins most of its intrusions with a call in which the attacker poses as internal IT and asks the employee to enrol a FIDO2 passkey or update MFA. The call often arrives on a personal mobile, and in some campaigns the corporate help desk number is spoofed on the display.
Because Keepnet vishing campaigns are built from customisable voice templates rather than fixed consumer scripts, you can model that exact call: an internal IT voice, a deadline, and a request to complete an identity change while the call is running. What you measure afterwards is not whether people recognised a scam. It is whether they refused to complete an identity change on an inbound call and verified through a channel the caller did not control.
Run it against the roles that hold that power. Help desk agents, IT administrators, executive assistants and finance approvers meet this pretext first.
Source: Google Threat Intelligence Group, UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments, August 2026.
Keepnet Voice Simulation Data in the 2026 Verizon DBIR
The 2026 Verizon Data Breach Investigations Report is the first edition to include voice and SMS phishing simulation data at this scale, and part of that data came from Keepnet. Keepnet is listed among the contributing organizations (Verizon 2026 DBIR, p. 118).
The finding is short. Phone-centric phishing simulations show a median click rate of 2 percent, against 1.4 percent for email simulations, which the report records as an increase of 40 percent in the median click rate (Verizon 2026 DBIR, p. 50). On the same page the DBIR team notes that they struggled to find companies running voice and text message simulations at all. That is why the number was missing until this edition.
Delivery is the other half of the question, because a call that never connects teaches nothing. In Keepnet platform data covering 1 January to 14 August 2026, voice campaigns reached a 97.9 percent connection rate across 1,799 call attempts, measured on a consenting anonymized subset of customer accounts.
Free Voice Phishing Simulation Test
Discover Keepnet's Simulated Phishing Tests
Success Stories
In just two months, Keepnet has proven to be an invaluable asset for Motor City Casino.
The customizable social engineering campaigns and ease of use have helped us effectively train our employees against voice and SMS phishing, strengthening our security posture.
Keepnet’s Vishing Simulator helped us craft scenarios tailored to our culture and goals, enabling our employees to identify, report, and counter cyber-attacks coming from phone.
Keepnet contributed to a 30% increase in business efficiency, and our ability to identify and stop risks increased 12-times more.
By implementing vishing simulations and enhancing our processes, we increased our control over vishing attacks and eliminated them 12 times faster.
Our employees showed a 92% improvement in recognizing fake phone calls.
Resources
How Teknosa Silenced Vishing Scammers
How Teknosa Turned the Tide on an Ongoing Voice Phishing Risk Across 211 Retail Locations, with a Potential $439,250 Annual Loss!
Comprehensive datasheet on vishing simulation
Discover our robust protection against vishing attacks and explore the array of key features and benefits we provide.
Discover our in-depth whitepaper on vishing
Delve into our comprehensive whitepaper to understand the intricate landscape of voice scams and see strategic approaches.
Vishing in 2023: A Deep Dive into Rising Cyber Threats
Explore the escalating threat of vishing in 2023, its profound impacts, and the need for effective countermeasures.
Explore visual information about vishing attacks
Explore our visually engaging infographic to get insight on the world of voice scams and uncover key statistics.
Watch our high-level technical video on YouTube
See the features and capabilities of our solution in action, how we empower your business to tackle voice scams with confidence.
Schedule your 30-minute demo now
Frequently Asked Questions
Voice phishing, also known as vishing, is a type of social engineering attack where scammers use phone calls to trick individuals into giving out sensitive information, like passwords, credit card numbers, or personal identification details. The attacker usually pretends to be a trusted entity, such as a bank representative or government official, to gain the victim's trust and manipulate them into sharing confidential information.
The most reliable defense is behavioral. Run regular vishing simulations so employees experience a realistic voice phishing call in a safe setting, require out-of-band verification for any sensitive request that arrives by phone, and enforce a help desk policy that never resets access or MFA on a phone call alone. Technical controls help, but the decision that stops the attack is made by the person answering the call.
Vishing simulation training is important for enhancing the cybersecurity awareness of employees within an organization. By simulating realistic voice phishing attacks, this training helps individuals recognize and respond appropriately to fraudulent attempts to gather sensitive information over the phone. Such preparedness significantly reduces the risk of data breaches and financial loss, making vishing simulation an essential component of a comprehensive cybersecurity strategy.
Companies should use a vishing simulation to better equip their employees against the increasing threat of voice phishing attacks. Vishing simulation provides a practical, hands-on experience in a controlled environment, allowing employees to learn and make mistakes without real-world consequences. This proactive approach is significant for building a resilient defense against potential voice scammers and protecting sensitive company data.
When selecting a vishing simulation, companies should consider several key factors to ensure effective training. These include the realism of the simulations, the ability to customize scenarios to reflect specific vishing threats the company might face, ease of integration with existing training programs, and comprehensive reporting features to track employee progress and identify areas needing improvement. Additionally, the cost and customer support offered by the vendor are important considerations.
Yes, vishing simulation can be effectively integrated with other security training measures to provide a holistic approach to cybersecurity education. Combining vishing simulations with training on phishing, malware, and other cybersecurity threats creates a comprehensive vishing awareness training program that enhances overall security posture. Integration with incident response drills and real-time alert systems can also improve organizational preparedness and response to actual attacks.
Vishing simulation training should be conducted regularly to keep security awareness high and ensure that employees are equipped to handle new and evolving threats. Best practices suggest conducting training sessions quarterly or biannually, complemented by spontaneous vishing tests to assess readiness. Regular updates to training scenarios to reflect the latest vishing tactics are also important.
To begin vishing simulation training, organizations should first assess their current vulnerability to voice phishing attacks. This involves understanding the types of information typically targeted by vishers and the common tactics used. Following this, selecting a suitable vishing simulation based on the factors mentioned earlier is key. Organizations should then roll out the training in phases, starting with high-risk departments. Continuously monitoring the effectiveness of the training and making necessary adjustments ensures the program remains relevant and effective.
Vishing, or voice phishing, involves fraudsters using phone calls to extract confidential information. Keepnet's Vishing Simulation combats this by offering over 200 AI-powered simulations in 77 languages. It trains employees to recognize and respond effectively to such attacks, enhancing your organization's defense against this growing threat.
Absolutely. The voice phishing simulation offers extensive customization options, allowing you to create tailored vishing scenarios that reflect your specific organizational context and the unique threats you face. This customization enhances the relevance and effectiveness of the training.
Keepnet's Vishing Simulation uses AI-powered text-to-speech technology, enabling a wide range of realistic voice scenarios. This AI-driven approach ensures that voice phishing simulations are sophisticated and varied, providing a more effective training experience.
Keepnet's Vishing Simulation trains employees to recognize the nuances of vishing calls, enhancing their critical thinking and response skills. By exposing them to various scenarios, including those using AI-generated voices or custom-recorded messages, employees learn to identify suspicious elements in real time calls, reducing the likelihood of falling victim to actual vishing attacks.
Absolutely. Small and medium-sized enterprises (SMEs) are often targets of vishing attacks. Keepnet's Vishing Simulation is scalable and can be tailored to SMEs' specific needs and resources. It provides an affordable, effective tool for enhancing their cybersecurity posture against voice phishing threats.
Organizations can save up to $1-5 million annually using the Keepnet Vishing Simulation from potential breaches and incident response processes. Significant savings come from avoiding the costs associated with vishing attacks, such as data breaches, financial fraud, and legal penalties.
Regular training with Keepnet Vishing Simulation helps organizations comply with privacy regulations, reducing the risk of costly fines and legal actions associated with data breaches and information theft.
The Vishing Simulation offers automated reporting, providing detailed insights into employee performance and the effectiveness of their responses to simulated vishing attacks. This data is important for assessing the success of your security awareness training program and identifying areas for improvement.
The voice phishing simulation supports 77 languages, making it an ideal training tool for global companies with diverse, multilingual teams. This ensures effective training for all employees, regardless of their primary language.
Keepnet Vishing Simulation offers exceptionally realistic scenarios by allowing you to upload your own voice recordings or use AI-based text-to-speech technology. This feature enables you to create incredibly authentic scenarios, mirroring the tone and style of actual vishing calls. Additionally, the simulation guides users through interactive steps, simulating real-life interactions and decision-making processes. This level of customization and interactivity significantly enhances the training's realism, preparing employees more effectively for the types of vishing attempts they may encounter daily.
Yes. Every Keepnet product can be bought on its own, so you can run voice phishing simulations without also buying the security awareness training library. Teams that already deliver training elsewhere often start with the voice channel alone. Pricing is based on the number of employees, so there is no single list price for one product. Tell us your headcount and which products you need, and we will send a figure.
Susceptibility is the share of employees who give away information or follow instructions during a simulated vishing call. The first campaign sets the baseline and every campaign after it is compared against that number. Alongside susceptibility, track reporting rate, time to report and repeat exposure. Keepnet reports all four, gives each employee a human risk score and benchmarks the result against your industry, so the trend can be presented to leadership rather than described.
They receive a phone call from one of your own local numbers, in their own language, using either an AI generated voice or a recording you supply. The scenario comes from a library of 5,400+ voice phishing templates or one you write yourself, and the script can be personalized per employee with merge tags. Calls are scheduled across different days and hours so employees do not warn each other. The response is recorded, feedback is immediate and training is assigned only to the people who failed.
Yes. Vishing campaigns are built from customisable voice templates, so the scenario can follow the pattern Google Threat Intelligence Group reported in August 2026 for the UNC6671 cluster: an internal IT voice, a passkey enrolment or MFA update request, and a deadline. The measurement that matters is whether the employee refused to complete an identity change on an inbound call and verified on a separate channel.
Social engineering is the number one human risk in the SANS 2026 Security Awareness and Culture Report, and the report links the growth of vishing and smishing partly to the fact that organizations have little control over, and little visibility into, the mobile devices their employees use every day. A phone call leaves no message in a mail gateway and no entry in a filtering log, so the voice channel is usually the least measured one in the whole programme. Running voice simulations is how a team finds out how it behaves on the phone instead of guessing. (SANS, Security Awareness and Culture Report, 2026, p. 10)