Deepfake phishing capabilities: the short answer

We built this matrix because buyers kept asking us the same question in demos: what can each platform actually do? Feature pages blur together. “Deepfake simulation” can mean a pre-rendered clip in a training module or a live, two-way likeness that joins a Teams meeting and talks back. Those are not the same capability, and they do not test the same control.

The video above is the difference in 28 seconds. Voice, email and Teams, chained, with each stage built on what the target did at the stage before it. That chain is what the matrix below measures, one capability at a time. For the wider market view, see our deepfake phishing simulation vendors roundup and the 12-criterion best deepfake simulation platform scorecard.

How we graded each vendor

Every cell reflects what each vendor publicly documents or has confirmed, as of October 2026. Breacher.ai cells reflect capabilities in the shipping OSES™ platform. The four marks:

Read the open circle carefully. “No public evidence found” means we could not find a public claim. It is not a statement that the capability is absent, because several vendors keep product documentation behind a login or a demo. Any vendor listed here is welcome to send public documentation to support@breacher.ai, and we will update the matrix.

The four capability families

Breacher.ai: sixteen of sixteen. The next closest platform: six. The capabilities group into four families, and each family tests a different part of how deepfake fraud reaches a consequential action: a payment, a credential reset, an MFA enrollment, a new account.

Only one of these six platforms has a proprietary deepfake risk score

Here is the row that matters most to a CISO, and the one no other platform in this comparison has built. Several vendors score people. Adaptive publishes a unified per-user human risk score. Hoxhunt publishes a general security score. Doppel describes risk modeling for high-risk users. Those scores answer a useful question: who is likely to fail? They route training. They do not answer the question a board asks after the next deepfake headline: would we survive one, and how do we compare?

The OSES™ Score is the proprietary deepfake risk score built for that question. It is computed from deepfake and voice simulation outcomes, the channels where the consequential action actually happens, and it is placed against your sector median from the Social Engineering Risk Index.

A single number gets risk backwards. An organization where almost nobody engaged, but one person read a verification code to a synthetic voice on a Teams call, looks excellent on a click report and on most per-user dashboards. On the OSES™ Score, Depth catches it immediately. That is the difference between a score that describes people and a score that describes exposure.

“We scored Medium” starts a debate. “We scored Medium and our sector median is High” ends one.

Eight capabilities only Breacher.ai shows in full

On eight of the sixteen rows, Breacher.ai is the only vendor with a verified mark. These are not edge features. They are the steps where real deepfake fraud turns a conversation into a consequential action, and the score that tells you whether it did.

Where each vendor stands out, and where it stops

Every vendor here is pushing deepfake simulation forward, and each one does something well. Each one also hits a ceiling. Here is both, straight from the matrix.

Why capability depth matters: test the procedure, not the eye

A capability matrix is only useful if it measures the thing that protects you. Our view is set out in our detection training is a decaying control analysis: training people to spot a deepfake by eye and ear loses value every time generation quality improves, while a verification procedure, a callback to a number already on file or a second approver, asks the same question of a crude fake and a perfect one.

A workforce that invokes process defeats our red teams. Users who spot fakes do not, at least not consistently.

That is why the capabilities that separate this matrix matter. A simulation that stops at a pre-rendered clip tests whether someone noticed. A simulation that runs the callback, puts a live likeness on a Teams call and scores whether the verification step fired tests the control that keeps its value. It is also why we treat verification procedure training as the outcome, and process invocation as the behavior to build.

Precise about the claim. This is an argument about where human judgment sits, not against technology. Machine identity verification in hiring and customer onboarding, document checks, liveness and synthetic media screening, deserves investment, and deserves testing to prove it holds. A better fake does not break a verification step directly; it raises the pressure to wave the step through, which is why we measure the exception rate.

How to use this matrix in your evaluation

Treat the matrix as a shortlist tool, then ask every vendor to show, not describe. Six requests separate a demo from a deployment:

Run those six against the deepfake phishing simulation platforms on your shortlist. The answers will sort the field faster than any feature page.

How Breacher.ai runs it

Breacher.ai OSES™ runs authorized, fully automated, orchestrated simulations across email, SMS, voice, Microsoft Teams, Zoom and video. Its AI voice agents hold live two-way conversations and answer the inbound callback. Its interactive avatars join meetings and talk back. Every finding is named against the procedure that failed, scored on the OSES™ Score, and placed against your sector. Then the Secure Behavior Management platform generates training from your own procedures, aimed at the step that did not hold.

Run it as a platform, as a managed program, or through an MSP or MSSP partner. Need a scoped, point-in-time engagement instead? Our deepfake red team engagement is designed around your workflows and reported against the procedures that failed. Voice-first programs start with AI vishing simulation.

Frequently asked questions