KnowBe4 has added simulated vishing capabilities to its security awareness platform, giving organizations a way to train employees against voice phishing and AI-driven deepfake audio attacks. The feature, announced July 30, 2026, sits inside the attack-and-simulation pillar of the KnowBe4 Platform and feeds results into the same risk scoring already used for email phishing and other training data.
Vishing has shifted from a niche tactic to a major initial access vector. CrowdStrike’s 2025 Global Threat Report recorded a 442% surge in vishing activity between the first and second halves of 2024. Mandiant’s M-Trends 2026 ranked voice phishing among the top infection methods, while the 2026 Verizon Data Breach Investigations Report found employees were 40% more likely to fall for phone-based simulations than traditional email phishing.
“An urgent phone call from someone pretending to be your IT department or a C-level executive creates instant pressure, and cybercriminals are using AI voice cloning to make these calls unbelievably convincing,” said Greg Kras, chief product officer at KnowBe4. “To build true organizational resilience, security teams can no longer focus solely on the inbox.”
Security teams can run customizable voice scenarios that use local caller IDs, realistic personas and multi-step tactics designed to mirror live attacker behavior. The system employs advanced text-to-speech and high-quality audio so that conversations feel interactive rather than scripted. Fail conditions and results flow into KnowBe4’s existing reporting and Risk Score, giving leaders a unified view of human (and AI-agent) risk across channels.
The capability launches in English (US and UK), Japanese, German, French, Spanish, Portuguese (Brazil) and Italian. It is available as part of the broader KnowBe4 Platform, with deeper AI-agent features unlocked in the SAT Advanced tier.
Most security-awareness programs still center on email. Phone-based social engineering exploits urgency, authority and the relative lack of technical controls on voice channels. AI voice cloning has lowered the skill barrier for convincing impersonation of executives or IT staff, making the gap more urgent.
KnowBe4 already offers related tools, including earlier Vishing Security Tests and the gamified “Spot the Vish” module released in June 2026. The new simulated capability extends that coverage into more realistic, multi-step conversations that security teams can schedule and measure at scale.
Whether organizations actually run frequent phone simulations and whether employees improve under realistic pressure will determine the practical impact. For security leaders already using KnowBe4’s phishing and training data, the addition closes a channel that attackers have been exploiting more aggressively. The company is demonstrating the feature at Black Hat booth #2439.
