Understanding the difference, and why it matters

Most platforms stop at the click. Modern social engineering does not: it is a voice, an action, and a consequence. The band a platform sits in decides how much of that it can even see.

The bands below describe typical products, not one named product. Individual vendors sit at different points inside a band and some straddle two, which is why the scorecard below scores them one at a time.

If what you need is a large compliance-based training library, we are not your vendor, and the rest of this guide will not change that.

We believe security is unique to every organization. Rather than shipping a canned catalogue, we give organizations the tools to curate training to their own environment, generated from their own policies, their own simulation results, or authored themselves.

If your obligation this quarter is a compliance checkbox, you can stop here.

Security is not a one-size-fits-all approach.

The third band tests the most, which does not automatically make it the right purchase.

Twelve criteria, six options, scored on public evidence

Start here if you are shortlisting. Each cell records what the vendor publicly documents as of September 2026, checked against their own product pages, pricing pages and published research. A blank cell means we could not find a public claim, which is not the same as the capability being absent. Several of these vendors gate their product documentation behind a login or a demo.

• ● Documented
• ◐ Partial, or documented with a material caveat
• ○ No public claim found

Compiled from each vendor's public website on 19 September 2026. We are one of the six, so read our column with that in mind, and verify any row that decides your shortlist directly with the vendor. Capability behind a login is real capability, it is simply not something we can check. If you represent a vendor listed here and a cell is wrong or out of date, tell us and we will correct it.

A platform that only sends the first message cannot measure anything past the click, and past the click is where the consequence lives.

Compare the outcome, not the channel list

Channel counts stopped discriminating years ago. Every platform can claim voice, video, and SMS. The question that still separates them is what comes out at the end: what the report can contain, what the number describes, and who the finding is written about.

If you are only measuring users, you are measuring the smallest part of the failure. A click rate is a statement about one person's judgment on one message. It says nothing about whether the help desk asked for a ticket, whether accounts payable called the number in the directory, or whether the procedure that was supposed to catch this was ever invoked. That is where the loss actually happens, and it is a property of the organization, not of the person who answered the phone.

Describes bands, not named products. Individual vendors sit at different points inside a band, and some straddle two.

The line between Generation 2 and Generation 3

Vendors use multi-channel and orchestrated as if they mean the same thing. They do not, and the difference is the whole gap between the second band and the third.

This matters for the number, not just for realism. Single-channel results look clean because they never look at the full chain. Measuring four channels separately does not reflect what happens when the stakes are real, and that gap is the distance between your training report and what an adversary would find.

Fidelity is a threshold, not a goal

All of the above is about structure. None of it matters if the synthetic media falls apart in front of someone paying attention, and this is the part most commonly misunderstood by the people writing the evaluation.

You are not measuring whether your people can spot it.

Breacher.ai engagement data, measured across tested participants and client organizations.

A control built on detection is a countdown.

Detection is a losing battle for humans, and the margin narrows with every model release. Procedural verification is the better control, because it does not depend on the fake being imperfect. If your awareness platform is still teaching people to spot the tells, it is not neutral, it is counter-productive: it builds confidence in a skill that is degrading, and a confident target verifies less.

Fidelity has one job: to remove detection from the experiment, so the procedure behind the person is the only variable left. For voice, the practical bar is a live agent that survives an interruption, an off-script question, and being placed on hold, rather than a clip. For video, a face that joins the call and responds in real time rather than a rendered playback link, working natively on all three of Teams, Meet, and Zoom rather than one of the three. We broke down what that looks like on a live call in our remote support simulation write-up.

There is a practical catch. Mediocre fidelity does not give you a cautious result, it gives you an unusable one, because afterward you cannot tell whether someone disengaged for the right reason or because the rendering looked wrong.

Measure the right thing

Whichever band you buy, the report is the product. Click rate is a delivery diagnostic for the email channel and little more, because a phone call contains nothing to click. Six numbers replace it, all anchored to a defined consequential action, and we published the dataset behind them in our 2026 deepfake benchmark.

What to do before you talk to any vendor

Three things, all free, all doable this week. They will tell you more about which band you need than any demo will.

• Write down the sequence, not the channel. One paragraph describing how someone would actually get to something that matters in your organization: who they would call, what they would ask for, and which system the loss lands in. That paragraph is your evaluation script. Hand it to every vendor and ask them to reproduce it end to end.
• Name the consequential action in advance. Not “engaged with the caller.” A specific privileged act: an MFA re-enrollment, a payment instruction change, a remote session accepted. If nobody can name it before the run, the report will have nothing to anchor to afterward.
• Ask each vendor where their sequence terminates. Then ask them to describe the branch logic between stages out loud. A vendor who can only describe the channels they support, and not what the second stage does differently when the first one succeeds, is describing multi-channel.

Where we sit, and the part that undercuts this guide

Now the uncomfortable part. Across our engagements, the platform an organization runs has not necessarily predicted how it performs. How the organization treats security matters more. Your awareness platform is a tool, and how you wield it is what matters. Run the same voicemail and callback technique across different organizations and the action rate ranges from zero to 34.5%.

The vendor is not necessarily the variable that moves the outcome. What correlates is whether a verification procedure exists and holds under pressure: whether the help desk can say no to an executive, whether people were told what to do rather than what to spot. You run this evaluation because you cannot fix a failure you have never observed, not because the tool is the fix.

“Kudos to your entire team. We haven't even seen the report and the whole company is talking about the risks of voice cloning. It's been a huge win for us already.”

Frequently asked questions