Skip to content
Voice and deepfake

The hardest exercise to run. And the one people remember.

A convincing voice on the phone defeats training that only ever covered email. Cyberdise runs voice exercises with an AI caller you brief, up to and including a cloned voice, and no call goes out until consent is on record.

Book a demoSee the safeguards
AI caller
briefed by you
Success criteria
chosen per module
Every call transcribed
audio only if you enable it
Deepfake ready
voice cloning included
An office employee on a phone call, unsure whether the caller is who they claim to be
Who calls

An AI caller places every call.

A voice is harder to doubt than an email, which is why it works and why most programs never test it. In Cyberdise, a virtual assistant makes the call and holds a two-way conversation with the person who answers. It follows the scenario you wrote and speaks with the voice you picked.

  • Talks in each person's language when the template has it, otherwise in English
  • Guardrails set how the caller handles the conversation
  • Can use each person's name and other personalization fields
  • Every call ends at a time limit you set
A vishing module in Cyberdise, with the scenario, the topic, the AI caller persona and the success criteria
Step by step

How a voice exercise runs

A partner usually sets this up for you. Cyberdise can also run it directly.

  1. 01BriefSet the topic of the call, who the caller claims to be and how they know the person, then add an opening line and a voice for each language.
  2. 02Set upPick the outbound number and the success criterion, then link a user group to the voice module.
  3. 03SchedulePlan the calls into the campaign like any other module.
  4. 04CallThe AI caller opens with your line and keeps talking until the call ends or the time limit is reached.
  5. 05ScoreEach call is transcribed and checked against your criterion, and any call that meets it shows as Vished in the campaign statistics.
A production planner taking a call and turning to answer a colleague who has looked up from a printed schedule

The voice can be cloned. That is what makes it land.

A vishing exercise does not have to use an unfamiliar voice. The caller can speak with a cloned one, so the call arrives sounding like someone the person has every reason to trust. It is the hardest test in the set, and it is meant for the few people an attacker would single out, not for everyone.

  • Chosen per language in the template, like any stock voice
  • Runs with the same guardrails as any other caller
  • Covered by the same consent entry, transcript and success criteria as every other call
Safeguards

A record of every exercise and every call.

Running a voice exercise across borders is a governance question before it is a technical one. Cyberdise keeps a record of who approved each exercise and what happened on every call, so you can defend the decision to a works council, an auditor or a regulator.

  • No call is placed until a consent entry is recorded, with name, IP address and timestamp
  • Audio is recorded only when you switch recording on
  • Anonymous campaigns mask transcripts in the interface and the API
  • Transcripts are deleted with the campaign, the module or reset statistics
  • Every exercise traceable to the person who approved it
A vishing exercise call inside a compliance boundary: calls come from verified outbound numbers, consent is recorded before any call, the exercise shows who approved it, and an audit trail covers every exercise and every call.
The rest of the platform

Run voice next to email and SMS, not apart from them.

Phishing and smishingMultichannel exercises built from the tactics attackers are using now.Phishing and smishing
AI Campaign AutomatorDescribe the campaign you need and get a running program.AI Campaign Automator
Behavioral risk scoringScores built from what people do, updated continuously.Behavioral risk scoring
See the whole platform
Do employees have to consent?
Consent is built in. Cyberdise places no call until the exercise's consent is on record, with name, IP address and timestamp, so you can always show who decided. Whether employees or a works council agree first follows your own policies. See the safeguards.
Which numbers do the calls come from?
From verified outbound numbers, per country, so the exercise stays inside the rules.
Is a cloned voice part of every exercise?
No. You pick the voice per language in each template, so most exercises can use a stock voice. Keep the cloned one for the few people in exposed roles.
Can it combine phone, SMS and email?
Yes. A campaign can hold voice modules alongside phishing and SMS modules. Each one is linked to its own groups and placed on the schedule separately.
How is a pass or fail decided?
You set the success criterion per voice module. It can be revealing credentials or a 2FA code, disclosing sensitive information, agreeing to an unsafe action, bypassing a verification step, keeping the call going past a length threshold, or any of these. A call that meets it shows as Vished, with the transcript on the person's record.

See one set up before you decide to run it.

We walk you through one voice exercise: the brief, the consent, caller identity and the audit trail.

Book a demoSee pricing