Security awareness vendor KnowBe4 has introduced a new simulation capability for voice phishing, or vishing. The feature is designed to help organizations train employees against phone-based social engineering attacks, which several industry reports say have increased sharply over the past two years.
Vishing has evolved from a niche tactic into a common attack vector, according to KnowBe4. To support that assessment, the company cites several external studies: CrowdStrike’s 2025 Global Threat Report recorded a 442 percent increase in vishing activity between the first and second half of 2024. Mandiant’s 2026 M-Trends report now ranks voice phishing among the most significant initial infection vectors organizations face. And Verizon’s 2026 Data Breach Investigations Report found, per KnowBe4, that employees are 40 percent more likely to fall for phone-based simulation tests than for traditional email phishing.
“A frantic call from someone claiming to be from IT or company leadership creates instant pressure. Criminals are using AI voice clones to make these calls sound convincing,” said Greg Kras, Chief Product Officer at KnowBe4, according to the company. Security teams, he added, can no longer focus solely on the email inbox to build organizational resilience.
Simulated vishing attacks are now available within the “Attacks & Simulations” area of the KnowBe4 platform. According to the vendor, the feature is intended to protect both human employees and AI agents. Results feed into the same reporting and risk visibility as existing phishing and training data, and factor into the company’s proprietary Risk Score, which KnowBe4 says provides a cross-channel view of human and AI-related risk.
Among the capability’s key elements, per KnowBe4: it extends existing awareness training to cover phone communication, described as one of the fastest-growing and least-tested vectors for social engineering. Employees can practice recognizing high-pressure phone tactics in a controlled environment before encountering them in a real attack. For security leaders, the company offers vishing susceptibility reports intended to provide a data-driven view of voice-based risk that feeds into the overall Risk Score. The simulations themselves, according to KnowBe4, use local caller ID, realistic role scenarios, and customizable multi-stage scripts designed to mirror how real vishing attacks unfold.
Kras said organizations breached this year were typically not fooled by a generic phone scam script, but by a patient, adaptive conversation that appeared legitimate at every step. Training employees for anything less, he said, fails to prepare them for the threat they will actually face, according to the company.
With this expansion, KnowBe4 is addressing a gap security leaders have flagged for some time: while email-based phishing has long been the focus of awareness programs, phone communication has remained a blind spot in many training strategies. The rise of generative AI has made voice cloning easier and cheaper to carry out, a factor that has contributed to vishing’s growth as an attack method, according to industry reports cited by the company. KnowBe4 positions the new simulation capability as a complement to existing phishing and awareness programs rather than a replacement, arguing that organizations need consistent, cross-channel visibility into where employees remain vulnerable.
KnowBe4 says it will demonstrate the new capability at its booth (No. 2439) at the Black Hat conference. Further information is available on the company’s website.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de