Topic starter
19/08/2026 3:40 pm
TL;DR: AI voice cloning makes vishing more convincing and more scalable, according to Living Security Human Risk Management Platform. Phone-based trust now needs explicit verification steps, not just awareness lessons, when high-risk requests reach finance, help desk, or access workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Voice Phishing Awareness Training That Changes Behavior”.
Key questions
Q: Why does phishing remain effective even when employees are trained?
A: Phishing remains effective because attackers exploit urgency, familiarity, and normal business processes, which can overwhelm training in the moment.
Q: How do organisations know if vishing controls are actually working?
A: They know by measuring behaviour under pressure, not by counting training completions.
Q: What breaks when AI voice cloning is used in vishing attacks?
A: What breaks is the assumption that a familiar voice is enough to establish trust.
Practitioner guidance
- Define out-of-band verification for high-risk requests Require a second channel for any request involving payments, password resets, account changes, or privileged access, and make the approved verification path easy to follow.
- Run role-specific vishing simulations Test finance, help desk, executive assistant, and IT support roles with realistic phone scenarios so the team practises pausing, challenging, and escalating under pressure.
- Replace awareness-only training with behaviour metrics Track who reports suspicious calls, who verifies requests correctly, and who complies during simulations so the programme measures behaviour, not attendance.
Bottom line: AI voice cloning extends vishing by making impersonation more believable and more scalable than standard awareness programmes can handle.
Glossary terms: Voice Phishing, Voice Cloning, Human Risk Management, Out-Of-Band Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:19 pm
AI voice cloning has turned vishing from a persuasion problem into a verification problem. Once an attacker can sound like a trusted executive or help desk caller, the weakness is no longer employee ignorance alone. The real control gap is the absence of reliable, repeatable verification under pressure, which means security teams must treat voice trust as a governed access path rather than a soft awareness topic.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: What should teams do when voice-based impersonation targets payment or access workflows?
A: They should treat those workflows as high-risk control points and require independent verification before any action is approved. Finance, help desk, and privileged access processes need explicit rules for callbacks, approvals, and escalation so an attacker cannot rely on a single persuasive conversation to trigger a sensitive change.
👉 Read our full editorial: AI voice cloning is exposing the limits of vishing training