New voice-phishing simulation technology helps organizations prepare employees for one of the fastest-growing cyberattack vectors as AI-powered impersonation threats continue to rise
KnowBe4 has introduced a new simulated vishing capability designed to help organizations strengthen defenses against voice-based social engineering attacks, a threat vector that is rapidly gaining momentum as cybercriminals increasingly leverage artificial intelligence and voice-cloning technologies.
The new capability extends security awareness training beyond traditional email phishing simulations and enables organizations to train employees against increasingly sophisticated phone-based attacks. The launch comes at a time when voice phishing, commonly known as vishing, has emerged as one of the most effective methods used by attackers to gain access to corporate systems, steal credentials, and compromise sensitive information.
According to KnowBe4, cybercriminals are moving beyond generic scam calls and adopting more advanced tactics that use AI-generated voices, impersonation techniques, and carefully crafted conversations designed to manipulate employees into bypassing security controls. These attacks often involve individuals posing as IT support personnel, senior executives, financial officers, or trusted external partners.
“An urgent phone call from someone pretending to be your IT department or a C-level executive creates instant pressure, and cybercriminals are using AI voice cloning to make these calls unbelievably convincing,” said Greg Kras, Chief Product Officer at KnowBe4.
The company’s simulated vishing solution is integrated into the KnowBe4 Platform and allows security teams to create realistic voice-phishing scenarios that mirror actual attack techniques. Organizations can design customized simulations using local caller IDs, realistic personas, and multi-step engagement scenarios intended to replicate modern vishing campaigns.
One of the primary goals of the platform is to help employees recognize high-pressure social engineering tactics before they encounter them in real-world situations. Rather than learning through an actual breach attempt, staff members can experience simulated attacks in a controlled and safe environment.
“An urgent phone call from someone pretending to be your IT department or a C-level executive creates instant pressure, and cybercriminals are using AI voice cloning to make these calls unbelievably convincing.”
Greg Kras, Chief Product Officer, KnowBe4
The new capability also provides security leaders with detailed reporting and visibility into employee susceptibility to voice-based attacks. Results are integrated into the company’s broader risk analytics framework, helping organizations gain a unified view of human and AI-related security risks across multiple communication channels.
Among the key features of the platform are:
Key Capabilities
- Voice-based security awareness training focused on modern social engineering threats.
- Realistic attack simulations using customizable scenarios and caller identities.
- Employee resilience testing through live interaction and conversational engagement.
- Centralized reporting and analytics for measuring organizational exposure.
- Integration with risk scoring systems for improved visibility into human-related security risks.
- Customization options that reflect real-world attacker methodologies.
KnowBe4 believes that traditional security awareness programs focused primarily on email are no longer sufficient in today’s threat landscape. As attackers increasingly adopt AI technologies to automate and personalize attacks, organizations must expand training efforts to address a broader range of communication channels.
“The organizations getting breached this year were not tricked by a generic phone scam script, but rather by a patient, adaptive conversation that felt legitimate at every step,” Kras added. “Training employees against anything less than that is not training them for the threat they will actually face.”
The launch reflects a broader industry shift toward defending against AI-enhanced social engineering campaigns. As voice-cloning technology becomes more accessible and convincing, security experts warn that organizations must prepare for a future where phone calls, video messages, and other forms of communication may be increasingly difficult to distinguish from legitimate interactions.
By introducing simulated vishing as part of its security awareness platform, KnowBe4 aims to help organizations build stronger cyber resilience and better prepare employees to identify and respond to evolving voice-based threats before they result in security incidents.
