Topic starter
19/08/2026 3:24 pm
TL;DR: AI-powered vishing is making voice phishing more convincing, scalable, and adaptive than traditional awareness training can absorb, according to Living Security Human Risk Management Platform. The practical shift is toward automated simulations that measure real employee behaviour under pressure and connect human-risk data to identity and access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Why You Need Automated Vishing Security Testing Now”.
Key questions
Q: What breaks when organisations rely on awareness training alone against vishing?
A: Awareness training breaks down when the attacker can adapt tone, urgency, and context in real time.
Q: Why do AI voice attacks increase the risk of credential disclosure?
A: AI voice cloning makes impersonation more believable and scalable, which means employees cannot rely on obvious audio cues to detect fraud.
Q: What are the signs that a vishing programme is not working?
A: A weak programme shows high training completion but little change in disclosure behaviour, repeat failures in the same roles, and no link between test outcomes and access risk.
Practitioner guidance
- Run AI-powered vishing simulations Test employees with realistic voice scenarios that adapt to responses, then track disclosure, escalation, and report rates across roles.
- Correlate simulation results with identity data Join human-risk outcomes to job role, privileged access, and support-path exposure so remediation matches business risk.
- Replace static scripts with current threat scenarios Refresh test content from emerging vishing techniques, including voice cloning and authority impersonation, so the exercise reflects current attacker tradecraft.
Bottom line: AI-powered vishing turns voice phishing into a scalable impersonation problem that traditional awareness programmes do not fully absorb.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Automated vishing is now an identity problem, not just an awareness problem. The article shows that voice attacks no longer rely on crude deception alone; they now target the human decision point that sits in front of credentials, MFA, and help desk workflows. That makes the control question one of identity governance, because the real issue is who can be socially engineered into authorising access. Practitioners should treat voice-driven impersonation as a front door to identity abuse.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should organisations use vishing test results in human risk management?
A: Use them to prioritise intervention by role, access level, and observed behaviour, not just by who failed. A user with privileged access who discloses information in a simulation represents a different governance problem from a low-risk employee. The best response is targeted coaching, tighter verification steps, and, where needed, access review or policy adjustment.
👉 Read our full editorial: Automated vishing testing reveals the limits of awareness training