CISO Guide 2027: the plan in one paragraph

We run orchestrated social engineering simulations against enterprise organizations every week, across email, voice, Microsoft Teams and video, with AI voice agents that hold a live two-way conversation. This guide is the program we would put in front of a CISO building next year’s plan. For the threat outlook itself, read our top 3 emerging AI social engineering risks for 2027. For the deepfake-specific playbook, see the CISO deepfake defense guide.

The adversary got faster in 2026. The good news for 2027: the control that beats it is cheap, testable and already yours to deploy.

What changed going into 2027

Three shifts define the threat model a CISO plans against in 2027. None of them is a new technique. Each one removes a constraint the adversary used to live with.

The pattern underneath all three is synthetic normalization: plausibility beats fidelity. Microsoft’s Q2 2026 data shows technical support impersonation as the dominant lure on Teams, with more than half of Teams phishing attacks in June using generic display names rather than obvious IT support names. The request does not need to look perfect. It only needs to fit a workflow your people already trust, which is exactly why the workflow, not the disguise, belongs at the center of your threat model.

What got worse in 2026: agentic AI made mass voice phishing work

Of the three shifts, one moved further than any other this year. An AI voice agent can now run the entire voice phishing sequence on its own: place the outbound call, leave the voicemail, take the inbound callback, and hold a live two-way conversation that answers questions and steers toward the request. Then it does the same thing with an entire workforce at once.

We know because we run exactly these agents in authorized simulations, and we have measured the change. A year ago the results were mixed. Roughly 1 to 3 percent of users contacted fell for an AI voice agent, and most people could still tell they were talking to a machine. Across our most recent agentic voice simulations, the weighted mean action rate is 11.5 percent of users contacted, with a range from 0 percent to 34.5 percent of users contacted.

Three things changed, and each one is visible in the field:

Outside data shows the channel growing even before you count agents. In its 2026 Digital Defense Report, Microsoft puts the weekly volume of confirmed malicious voice phishing over cross-tenant Teams calls up 502% from the same time last year, and found that 93% of the attackers it studied succeeded at least once in keeping a target on the line for 20 seconds or longer, the point where a social engineering script can begin. The same report warns that AI can effectively automate social engineering attacks of many types, circumventing language and skill barriers. Mass voice phishing is no longer constrained by labor. That is the single biggest change a 2027 threat model has to absorb, and we break down the full sequence in our AI voice agent interactive loop findings.

What we are seeing in the field

A threat model should be built from what actually works against organizations, not from headlines. We run these simulations as weekly engagements, and six patterns keep showing up. The full write-up is in our AI vishing field findings.

Read those six together and the conclusion is uncomfortable for a catalog training program. The pretexts that work in the field carry no red flags, arrive on channels the training never covered, and are defeated by process rather than perception. A program aligned to that threat model looks very different from one aligned to last year’s phishing email, and so does the risk score that measures it.

Why generic awareness training is not the answer in 2027

Security awareness training has real value. It builds a reporting culture, explains the threat, and teaches people to pause on unusual requests. The problem in 2027 is not awareness. It is fit.

Classic red-flag training teaches people to watch for pressure, urgency and an unfamiliar voice. The help desk callback we run in the field presents none of them. The employee dialed the number. The request is routine. Support is outsourced, so an unfamiliar voice is normal. Every cue reads safe, a false green flag, and the training designed to catch the scam never fires.

Your verification step is not anyone else’s. Your approvers, your help desk ticketing rules, your vendor onboarding flow and your wire thresholds are specific to you. A catalog course written for every organization cannot teach the callback your accounts payable team is supposed to make, because the vendor that wrote it has never seen your procedure. Catalog content also plays catch-up: by the time a new pretext becomes a library module, it has already been used against someone.

That is why training has to be aligned to your policy, procedure and process, and to the security controls you actually run. Those are three different layers, and generic content touches none of them.

Hyper-training users is the wrong answer too

The opposite reflex is just as costly. When the threat gets worse, many programs respond with more: monthly modules for everyone, longer courses, and automatic retraining after every click. That volume does not add control. It teaches people to click through training the same way they click through warnings, and it spends attention on topics most roles will never face.

The goal is not more training. It is less training that maps to more control.

No bank relies on a teller’s eye alone to catch a counterfeit note. It requires the check. The bill got better. The check did not have to. That is why the best deepfake security awareness training in 2027 teaches the verification step and its trigger, not a list of visual artifacts the next model release will remove.

A workforce that invokes process defeats our red teams. Users who spot fakes do not, at least not consistently.

This is an argument about where human judgment sits, not against technology. Machine-level identity verification belongs in the threat model, especially in hiring and customer onboarding: document verification, liveness checks, validation against authoritative sources and synthetic media screening on the interview channel, with a hard gate before any account is provisioned. Those controls deserve investment, and they deserve testing to prove they hold.

Precise about the claim. A better fake does not break a verification step directly. It raises the pressure to wave the step through. That is why a 2027 program measures the exception rate, the share of required checks that are skipped or satisfied on the wrong channel, rather than claiming any procedure is unbreakable.

Understand your risk, and how you rank against your peers

A CISO cannot prioritize what cannot be measured, and cannot defend a budget without context. Two numbers do both jobs: your own social engineering risk, and where it sits against organizations like yours.

The two terms matter because a single number gets risk backwards. An organization where almost nobody engaged, but one person handed credentials to an external endpoint, looks excellent on a click report. An organization where many people moved but nothing followed looks like a crisis. Depth catches the first, Spread catches the second, and the band is never reported without both. We publish how the score is built and how the index is computed, because a benchmark a CISO cannot defend in front of a board is not worth having.

Why peers matter. “We scored Medium” starts a debate. “We scored Medium and our sector median is High” ends one, in either direction. Rank turns a risk number into a decision about where the next dollar goes.

How to align awareness training to your threat model

The program runs as a loop. You model the threat, measure your exposure to it, see where you stand against your sector, and point training at what the score found.

The threat model is not a list of scary scenarios. It is a list of consequential actions: an outbound payment, a vendor banking-detail change, a credential reset, an MFA enrollment, a privileged access grant, a software install on request, a data export, a new account provisioned for a hire. For each one, ask which channels can reach the person who performs it, which pretext an adversary would use, and what step should fire before they act.

Threat model to training map

Here is how six 2027 threats translate into a procedure to train and a way to test it. Use it as a starting template for your own.

Notice what the map does to training once your score shows which rows are weakest. A finance clerk and a service desk analyst no longer receive the same module. Each receives the procedure they are actually asked to perform, in the channel they are actually reached on. That is what risk based security training should mean: training sized to the risks your threat model ranks highest. It is also what makes behavior based security training measurable, because each module points at a behavior a simulation can observe.

We built the tool to make that happen

Aligning training to a threat model used to mean months of custom content work. That is the gap we built the Breacher.ai Secure Behavior Management platform to close. It generates awareness training and matching simulations tailored to your organization and aligned to your security controls, in minutes, aimed at the paths your risk score says are weakest. Fewer modules, each one mapped to a control.

Training generates in any language, every element stays editable, and modules export as SCORM. The AI phishing simulation generator builds the matching scenario from the same source, so what people learn and what they are tested on line up exactly. It is the AI-powered social engineering training platform we wished existed when we started running engagements, and we explain the design choices behind it in how we built an AI-powered awareness training platform.

It fits the stack you already run: SOC 2, SSO, Entra ID and Google, plus an API, a CLI and webhooks. Already invested in Microsoft? The add-on for Microsoft Attack Simulation Training syncs with Entra ID and layers AI voice and deepfake video on top of what you run today. It is currently in beta, starting with a free 90-day pilot.

The 2027 CISO agenda: seven moves

Each move builds on the one before it. The first two need no simulation at all, so a CISO can start on day one of the new budget year.

Where the 2027 budget goes

Use this as a sanity check on next year’s line items. The question for each is simple: does it keep its value as the fakes improve?

What a CISO should report to the board in 2027

Boards asked about deepfakes in 2026. In 2027 they will ask whether the organization would survive one. Click rate cannot answer that, and in voice, Teams and video channels there is no link to click. Lead with your band and your peer rank, then show the process invocation rate that explains them. For framing the conversation itself, see how CISOs can answer the board about deepfakes.

Per-user results still matter. They route training to the people and process paths that need it. They are a routing input, not a board metric, because a score on a person does not tell you whether the wire goes out. Human risk management measures who is likely to fail. This program measures whether the organization survives when they do, which is why it sits comfortably above an HRM tool you may already own.

A 90-day plan for Q1 2027

Every step below starts with assets you already have: your process documents, your help desk, your finance team and your identity stack.

By the end of the first quarter, the CISO walks into the board meeting with a threat model, a risk band, a peer rank and a training plan aimed at the weakest paths. That is a fundamentally stronger position than a click-rate trend line.

How Breacher.ai runs the 2027 program

Breacher.ai was built for exactly this program. The OSES™ engine runs authorized, fully automated, orchestrated simulations across email, SMS, voice, Microsoft Teams and video. Its AI voice agents hold a live two-way conversation and handle the inbound callback, and orchestration means stage two changes based on what the target did at stage one, the way real adversaries operate. It is a sequence most simulation tools were not built to run end to end. Every finding is named against the procedure that failed, never against a person.

The simulation platform covers the full threat model in one program: deepfake phishing simulation software for voice, video calls and email, voice phishing simulation, help desk impersonation simulation, CEO fraud prevention testing and executive tabletop simulation. Need a scoped, point-in-time social engineering penetration test instead of a program? Our deepfake red team engagement is scoped to your workflows and reported against the procedures that failed.

Your people are not the weak point in 2027. They are the ones executing the procedure. Give them a procedure built for the threats they actually face, and give your board a risk number it can compare.

Frequently asked questions

Sources

• Microsoft Digital Defense Report 2026 (report page; vishing figures in the full report, July 2025 to June 2026)
• Microsoft Digital Defense Report 2026, full report (PDF)
• Microsoft Security Blog: Email threat landscape, Q2 2026 trends and insights, July 23, 2026
• CISA Advisory AA23-320A: Scattered Spider, help desk social engineering
• FBI IC3 PSA I-062822-PSA: Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions, June 28, 2022