Topic starter
19/08/2026 3:40 pm
TL;DR: AI-generated voice cloning is making vishing more scalable and more convincing, exposing the limits of compliance-based awareness programmes, according to Living Security Human Risk Management Platform. The practical shift is from generic training to behaviour-focused Human Risk Management that ties simulations, verification protocols, and risk signals to role-specific interventions.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Voice Phishing Awareness Training That Changes Behavior”.
Key questions
Q: What breaks when AI voice cloning is used in vishing attacks?
A: What breaks is the assumption that a familiar voice is enough to establish trust.
Q: Why does phishing remain effective even when employees are trained?
A: Phishing remains effective because attackers exploit urgency, familiarity, and normal business processes, which can overwhelm training in the moment.
Q: How do organisations know if vishing controls are actually working?
A: They know by measuring behaviour under pressure, not by counting training completions.
Practitioner guidance
- Define out-of-band verification for high-risk requests Require a second channel for any request involving payments, password resets, account changes, or privileged access, and make the approved verification path easy to follow.
- Run role-specific vishing simulations Test finance, help desk, executive assistant, and IT support roles with realistic phone scenarios so the team practises pausing, challenging, and escalating under pressure.
- Replace awareness-only training with behaviour metrics Track who reports suspicious calls, who verifies requests correctly, and who complies during simulations so the programme measures behaviour, not attendance.
Bottom line: AI voice cloning extends vishing by making impersonation more believable and more scalable than standard awareness programmes can handle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:19 pm
AI voice cloning has turned vishing from a persuasion problem into a verification problem. Once an attacker can sound like a trusted executive or help desk caller, the weakness is no longer employee ignorance alone. The real control gap is the absence of reliable, repeatable verification under pressure, which means security teams must treat voice trust as a governed access path rather than a soft awareness topic.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: What should teams do when voice-based impersonation targets payment or access workflows?
A: They should treat those workflows as high-risk control points and require independent verification before any action is approved. Finance, help desk, and privileged access processes need explicit rules for callbacks, approvals, and escalation so an attacker cannot rely on a single persuasive conversation to trigger a sensitive change.
👉 Read our full editorial: AI voice cloning is exposing the limits of vishing training