The short answer

You do not teach people to spot deepfakes. You teach them a verification step, such as calling back on a number they already hold, that they run before any consequential action no matter how real the request looks or sounds. Then you generate that training around your own policies, simulate the exact pretext, and re-test to prove the step holds. An AI-powered awareness training platform like Breacher.ai does all of it in one place.

We run deepfake simulations against enterprise populations every week: cloned executive voices, live video avatars on Teams, Zoom and Meet, callback agents that hold a real conversation. Across our engagements, 63% of more than 1,000 tested participants could not tell synthetic voice or video from a real person while it was happening to them. The people who held were not the ones with the sharpest ears. They were the ones who ran the procedure.

Why the spot-the-fake lesson expires

Every tell a course teaches today, the odd blink, the flat vowel, the smeared hairline, is a defect in the current generation of synthesis. The next model release engineers it out, on a schedule the adversary sets and the buyer does not. On a live call there is no inspection window either, because the decision happens inside the conversation. We make the full case in why deepfake detection training is a decaying control.

No bank measures whether a teller can eyeball a counterfeit note. It measures whether the teller ran the check.

What to teach instead: the step, not the tell

The trigger for verification should be the transaction, not a feeling of suspicion. A convincing fake removes the feeling. It cannot remove the transaction. So the training anchors to the consequential actions an impersonator is actually after:

• Outbound payments and vendor banking changes. Call back on the number already on file, never the one in the request.
• Credential resets and MFA enrollment. A ticket and a second channel before the reset, whoever is asking.
• Privileged access and software installs on request. An approval path that does not run through the person making the request.
• Data exports and disclosures. Confirmation through a channel the requester did not choose.

People stay at the center of this. They are the ones who execute the procedure under pressure, which is exactly why it is worth training and exactly why it is worth measuring.

Why generic training cannot teach your step

Here is the catch that makes this hard for most programs. Your verification step is not anyone else's. Your approvers, your help desk ticketing rules, your vendor onboarding flow and your wire thresholds are specific to you. A catalogue course written for every organization cannot teach the callback your accounts payable team is supposed to make, because the vendor that wrote it has never seen your procedure.

Awareness content has always played catch-up with the threat landscape, too. By the time a new pretext becomes a library module, it has already been used against someone. Security is unique to every organization, and training has to be as well.

If your training is not built from your own procedures, you are teaching somebody else's defense.

How Breacher.ai builds it, in minutes

This is the gap we built the Breacher.ai Secure Behavior Management platform to close. It is the AI-powered awareness training platform that instantly generates awareness training and simulations aligned to your organization, then proves the training worked.

It fits the stack you already run: SOC 2, SSO, Microsoft Entra ID and Google directory sync, SCORM export into your existing learning system, plus API, CLI and webhooks. Already on Microsoft? The add-on for Microsoft Attack Simulation Training augments what you have rather than replacing it. And pricing is a flat platform fee by tier, published on the pricing page, never per seat.

Compares a typical off-the-shelf deepfake module with the Breacher.ai platform. For how the wider market compares, see our deepfake simulation platform scorecard.

Where detection still earns its place

Broad awareness training is valuable. Recognizing a suspicious link, reporting a strange request, knowing who to call: every program should teach it, and Breacher.ai generates that content too. The argument here is narrow and specific. For synthetic voice and video, human perception should not be the control.

That is also not an argument against technical identity verification. Liveness checks, document validation against authoritative sources and synthetic media detection on the interview channel are strong layers, especially in the hiring path, and part of our job is testing whether they hold. Machines can keep pace with machines. What we stop asking is for a person on a live call to out-perceive a model.

What to measure

Completion tells you the training was delivered. These numbers tell you whether it worked.

What we would do first, this week, for free

• List your consequential actions. Payments, banking changes, resets, MFA, privileged access, exports. It fits on one page.
• Write the verification step next to each one. Every blank line is an uncovered path, and uncovered paths are where our engagements find the failures.
• Swap one spot-the-fake slide for the step. Replace "look for unnatural blinking" with "call back on the number you already hold before you act."

Frequently asked questions