Before the Comparison, Two Admissions

Search deepfake phishing simulation vendors and you get the same page nine times: voice cloning, video deepfakes, multi-channel coverage, a grid of checkmarks where every vendor wins on the dimensions it invented.

Two things upfront. We sell in this category, so read our name below with that in mind. And more uncomfortably: across our engagements, we have not found a meaningful correlation between which platform an organization buys and how it actually performs under simulation. More on that at the end.

Instead of a feature grid, score every vendor against one threat.

The One Criterion: IT Help Desk Impersonation Over Teams

In April 2026, Microsoft documented a technique it calls cross-tenant help desk impersonation: an attacker stands up an external tenant, messages employees inside Teams as IT support, and talks them into granting a remote session with legitimate tooling. Blumira replicated it and caught real attempts in the wild. It is the Scattered Spider playbook, and it is the single most probable path to compromise in a Microsoft 365 enterprise right now.

Almost no awareness program tests it. The lure never touches email, so there is no click to measure. We broke down the full chain here: IT Remote Support Simulation.

If not, the platform cannot simulate the attack your workforce is most likely to face. It also happens to require every capability that actually separates vendors:

• Contextual layer. The pretext is grounded in the target's real environment, not a template.
• Measurement beyond click rate. The outcome is a process failure with no click to record.
• Orchestration. Sequenced steps that condition on each other, not parallel channels fired at once.
• Threat research. Scenarios that track documented adversary behavior and move when the tradecraft moves.
• Security practitioners. People who have run these engagements deciding when to escalate and when to back off.
• Conversational capability. The target talks back, and a recording cannot survive that.

If your primary worry is CFO wire fraud rather than help desk compromise, pick that scenario instead. The point is not this specific playbook; it is that you should evaluate against a sequenced, conversational, no-click attack rather than a template library. Any of them exposes the same six capabilities. We use the Teams help desk case because it is the one attackers are running most right now, and because it is the one almost nobody's current program tests.

The Vendors

Each assessment is drawn from what the vendor publishes, and linked. Where a dimension is not documented, we say so rather than guess. Vendors: email us any correction and we will note it.

The Part That Undercuts This Article

Across our engagements, the awareness platform an organization runs does not predict how it performs. Run the same voicemail-and-callback technique across different organizations and the action rate ranges from 0% to 34.5%. One population had nobody act; another had roughly one in three, buying from the same short list of vendors.

What correlates is whether verification procedure exists and holds under pressure: whether the help desk can say no to an executive, whether people were told what to do rather than what to spot. That is the whole job of the evaluation.

How to Run the Evaluation

Bring these five steps to every vendor, including us. They will tell you which platform can actually run the modern threat, regardless of how the marketing positions it.

If a vendor cannot clear step 2, you have your answer in one meeting instead of six.

Frequently Asked Questions