We build and run authorized social engineering simulations against enterprise organizations as paid engagements. So when the market settled on a particular image of the deepfake threat, we tested it against what we actually see in the field. The picture that emerged is sharper, less cinematic, and far more useful than the pitch most of the category is running.

This post is about the finding that reorganized how we scope every engagement. The dangerous deepfake is not a video. It is a voice, in a loop, at scale.

How we measure

We score every simulation on a depth ladder: did the target engage, did they click, did they take an action such as entering a credential, and did that action reach a real consequence. A click alone never counts as a finding. We only credit a result when the action reaches something that matters, and we state the definition in play every time. That discipline is what separates an assessment from a vanity metric, and it is what lets us say with confidence where the risk actually sits.

Video is the wrong vector to watch

The image the market sells is a flawless pre-recorded video of your CEO that instantly moves money. It is the clip that photographs well for a conference keynote, and it is where most of the attention goes: video detection, spot-the-glitch training, the cinematic demo. In our engagements that one-way clip is consistently the weakest vector we run. Pre-recorded broadcasts produce clicks and meeting-joins, and very little that reaches a real consequence.

Read that carefully, because it is easy to misread. The point is not that synthetic video is harmless, and it is not that a live video call is harmless. A live, interactive video call is a conversation, and it converts for the same reason the voice loop does. The vector that fails is the pre-recorded, one-way clip. A convincing face delivered as a one-way blast gives the target nothing to respond to, so the sequence stalls before it reaches anything that matters. If your threat model is built around a pre-recorded video of an executive, you are watching the weakest vector while the one that works runs over audio.

Audio is the vector: a voice agent that calls back

The simulations that convert share a different shape: an interactive voice loop. The target dials a number back or holds a conversation with a live agent on the phone. That loop is where the consequences land in our engagements, by a wide margin. Our single largest result came from an autonomous AI voice agent running a credential-expiry pretext against hundreds of people at once, with no human operator on any call.

That result breaks a comfortable assumption: that deepfakes are surgical, deep but not wide. A human impersonating an executive can go deep or wide, not both, because nobody can staff hundreds of personalized calls. The AI agent does both at once. That is the categorically new thing. Not that a fake can be convincing, people have always been convincing, but that a convincing, interactive, authoritative voice now scales to hundreds of targets at the same time. The synthetic voice is doing real work here. What agentic autonomy adds is reach at a depth a human could only reach one call at a time.

Why audio wins

The field results say where the consequences land. The mechanics explain why they land on the phone and not on the screen.

The help desk beats the CEO

Conventional wisdom says authority bias tracks seniority: the more senior the impersonated title, the better the result. What we see in the field is close to the opposite. Ranked by consequences, the help desk persona outperforms every executive we impersonate, and the most senior titles, the CISO above all, are the hardest sell.

The driver is not altitude, it is routine plausibility. A help desk call about an expiring credential is something staff are trained to comply with. A personal call from the CISO is rare enough to trigger suspicion. The most dangerous impersonation is not the most powerful person in the building. It is the most ordinary request, the one that sounds like a Tuesday.

Synthetic voice wins the second move

When we run synthetic voice alongside conventional lures, email still reaches more people at first contact. That is expected. Where synthetic voice separates itself is what happens next: it is the vector that converts engaged people to credential disclosure.

The lesson is precise, and it credits the synthesis rather than dismissing it. Synthetic voice does not win by making the first touch more tempting. It wins by changing what happens after someone is already on the hook, inside a live conversation where a human-sounding, authoritative agent can press, reassure and redirect in real time. Reach is an email problem. Conversion is where the synthetic voice earns its reputation, and agentic autonomy is what lets that conversion run at scale.

Deepfake social engineering is not overhyped. The industry is just watching the wrong channel.

The fix follows the finding

If the threat is an interactive voice loop that converts a routine request into a disclosed credential, then the defense is not teaching people to hear the fake. That control decays with every model release, and we wrote out why in why detection training is a decaying control. The voice will keep getting better. Human perception will not.

What holds is a procedure that does not depend on anyone noticing anything. Three moves, in order:

• Add friction to the voice channel. Any consequential request that arrives by phone, a credential reset, an MFA change, a payment instruction, a data export, gets a verification step before anyone acts on it. The channel most organizations have left wide open is the one the loop is built to exploit.
• Require an out-of-band callback to a known-good number. Not the number that called you, and not the one in the voicemail. The directory number. A callback returns the same answer against a crude fake and a perfect one, because it does not read the audio. We walk through how to scope that in our voice phishing assessment guide, and the training logic in process over detection.
• Rehearse the ordinary call, not just the cinematic clip. Defend the help desk request about an expiring credential, because that is the impersonation that converts. Then test whether the procedure actually ran under pressure, rather than assuming it did.

Stop watching the video. Listen to the phone. The boring help desk call is the attack that works.

This is what the real-time voice agent changed, and it is exactly what Breacher.ai is built to reproduce. We run the whole loop as one orchestrated, fully automated engagement, the outbound call, the voicemail, the inbound callback and the live two-way conversation, driven by an autonomous agent rather than a person on the line. Every scenario terminates at a named consequential action, and the report tells you whether your verification procedure executed, separating a check that was skipped from one that was consciously waived. You cannot fix a failure you have never observed.

“Kudos to your entire team. We haven't even seen the report and the whole company is talking about the risks of voice cloning. It's been a huge win for us already.”

Frequently asked questions