KnowBe4 combats voice-based threats with simulated vishing

Cyberattack simulation and training company KnowBe4 has launched a simulated vishing (voice-based phishing) capability aimed at addressing the reported surge in attacks using the tactic.

The capability has been added to the attack and simulation pillar of the KnowBe4 platform. The solution is designed to help employees practice recognising high-pressure phone-based attack tactics in a safe environment rather than encountering them for the first time from a real attacker.

It uses real attacker tactics such as local caller ID spoofing, realistic personas and multi-step customisable scenarios to mimic how modern vishing attacks are carried out.

CrowdStrike’s 2025 Global Threat Report estimated a 442% surge in vishing activity during the first and second halves of 2024, while Mandiant’s M-Trends 2026 report ranks voice phishing as one of the top initial infection vectors in modern attacks. Meanwhile the 2026 Verizon Data Breach Investigation Report found that employees are 40% more likely to fall for phone-based simulation tests compared to email phishing.

KnowBe4 Chief Product Officer Greg Kras said an urgent phone call from someone pretending to be a C-level executive or part of the IT department can create instant pressure on employees.

“Cybercriminals are using AI voice cloning to make these calls unbelievably convincing,” he said. “To build true organisational resilience, security teams can no longer focus solely on the inbox. With our new simulated vishing capability, we are equipping security leaders with the tools needed to train employees across every major social engineering vector to prevent these types of attacks.”

Image credit: iStock.com/RobertAx