KnowBe4, the global leader in digital workforce security, securing both humans and AI agents, today announced its new simulated vishing capability designed to help organizations close what has become the fastest-growing gap in security awareness: the phone channel.

Vishing has moved from a niche tactic to a mainstream attack vector. CrowdStrike’s 2025 Global Threat Report cited a 442% surge in vishing activity between the first and second halves of 2024, and Mandiant’s M-Trends 2026 Report now ranks voice phishing among the top initial infection vectors organizations face. The 2026 Verizon Data Breach Investigations Report found that employees are 40% more likely to fall for phone-based simulation tests compared to traditional email phishing.

“An urgent phone call from someone pretending to be your IT department or a C-level executive creates instant pressure, and cybercriminals are using AI voice cloning to make these calls unbelievably convincing,” said Greg Kras, chief product officer, KnowBe4. “To build true organizational resilience, security teams can no longer focus solely on the inbox. With our new simulated vishing capability, we are equipping security leaders with the tools needed to train employees across every major social engineering vector to prevent these types of attacks.”

Simulated vishing is now available within the attack and simulation pillar of the KnowBe4 Platform, aimed to protect both humans and AI agents. Vishing simulation results feed the same reporting and risk visibility organizations already rely on for phishing and training data, influencing the Risk ScoreTM, which highlights one unified view of human and AI risk across channels. Highlights of the new capability include:

  • Training for Evolving Threats: Extends security awareness training to the phone channel, one of the fastest-growing and least-tested vectors for social engineering.

  • Real-World Resilience: Employees practice recognizing live, high-pressure phone tactics in a safe environment, rather than encountering them for the first time from a real attacker.

  • Visibility for Security Leaders: Reporting on vishing susceptibility gives security leaders the same data-driven view of voice-based risk that contributes to the overall Risk Score.

  • Real Attacker Tactics: Local caller ID, realistic personas, and multi-step customizable scenarios mirror how modern vishing attacks are actually carried out.

“The organizations getting breached this year were not tricked by a generic phone scam script, but rather by a patient, adaptive conversation that felt legitimate at every step,” Kras added. “Training employees against anything less than that is not training them for the threat they will actually face.”

Stop by the KnowBe4 booth at the Black Hat conference, #2439, to see simulated vishing in action. More information is available at https://www.knowbe4.com/products/security-awareness-training/features.

About KnowBe4

KnowBe4 empowers the modern workforce to make smarter security decisions every day. Trusted by more than 70,000 organizations worldwide, KnowBe4 is the pioneer of digital workforce security, securing both AI agents and humans. The KnowBe4 Platform provides attack simulation and training, collaboration security, and agent security powered by AIDA (Artificial Intelligence Defense Agents) and a proprietary Risk Score. The platform leverages 15 years of behavioral data to combat advanced threats including social engineering, prompt injection, and shadow AI. By securing humans and agents, KnowBe4 leads the industry in workforce trust and defense.

More info at www.knowbe4.com. Follow KnowBe4 on LinkedIn and Instagram.

Media gallery

About The Author
Business Wire