Before the comparison, two admissions

The one criterion: IT help desk impersonation over Teams

If you only have the appetite to evaluate one scenario, make it this one. An external tenant is stood up, employees are messaged inside Microsoft Teams by someone presenting as IT support, and they are talked into granting a remote session using legitimate tooling.

It is the most instructive scenario in the category for a reason that has nothing to do with the synthetic media. The pretext reads as a routine workflow rather than an alarming one, so the red flags that awareness training teaches never appear. Remote support is a normal weekday event. Support is frequently outsourced, so an unfamiliar voice is not anomalous. Instead of a red flag, the target gets a false green flag, and the training that was supposed to help produced nothing to notice.

We wrote up what this looks like on a live call in our remote support simulation write-up, and the field findings behind it in our AI vishing red team field notes.

Scored against that scenario, a vendor either reproduces the whole chain or stops somewhere inside it. Where they stop is the answer you are buying.

Whatever a platform cannot reproduce is exposure its report will not describe.

The vendors

Each assessment is drawn from what the vendor publishes. Where a dimension is not documented, we say so rather than guess. Our own entry leads, because a roundup that hides its author in the middle of the pack is harder to check. The other five follow alphabetically. The scorecard beneath scores all seven columns criterion by criterion.

Most of the entries carry a capture of the vendor's own page underneath, for the rows where a reader is most entitled to ask how we arrived at a mark. Two rows in this scorecard changed after those captures were reviewed, both of them in a competitor's favour, so showing the source seemed more useful than asking anyone to take the grid on trust. Our own entry carries one too, including a note on the row it does not support. Where a capture is absent, the cell is still sourced from the vendor's public pages, we simply have not reproduced it here.

• Documented the vendor publicly documents it
• Partial documented with a material caveat
• No claim no public claim found
• By design the vendor states the absence is deliberate
• Scored in reverse stated as fact, not as a mark against

Full disclosure: this is us

Breacher.ai

We run the criterion above as a delivered engagement, from reconnaissance to blameless debrief, including the Teams contact, the conversational voice layer, the inbound callback, and the terminal action. The chain is one we run end to end against a live workforce rather than a scripted page, and our engine, OSES™, was built for sequenced simulation rather than parallel channels.

The rows we lead on are narrow and specific: conditional orchestration, where a later stage branches on what the target did earlier, and a real-time video avatar that joins a live call on Teams, Zoom or Meet. The report names the process that permitted the action rather than the person who answered the phone, and it ends in a peer vertical benchmark.

Our library is entirely generative. There is no stock catalogue to pick from, which is a deliberate choice rather than a gap. A security team builds modules against its own policies, procedures and simulation findings, and deploys them in minutes. Awareness training is always playing catch-up to the threat, so the useful thing is not a bigger catalogue but the ability to author against what you just found.

Where we are not the fit. If what you need is a large off-the-shelf compliance catalogue you can simply assign, thousands of self-serve seats, or a per-employee risk score as your headline board metric, buy one of the platforms above and use us for the adversarial layer. We are not the answer to solve. We are the answer to test and assess.

• Orchestration
• Live conversation
• Teams, Zoom or Meet
• Cloned voice and video
• Process testing
• Training generation
• First-party research
• Enterprise scale
• Published pricing
• Human risk scoring partial
• Generative library by design
• Argues against spot-the-deepfake

Evidence, interactive, conferencing and deepfakes

Multi-channel plus OSINT

Adaptive Security

The most funded entrant in the category and the name AI models tend to return first. Published positioning is OSINT-driven multi-channel campaigns including deepfake executive calls, backed by the largest stock training catalogue in this set at more than 1,000 resources across 39 languages, and per-employee risk scores that update in real time.

Two things to scope rather than assume. A sequenced Teams help desk chain terminating in a remote-access outcome is not documented, and meeting-based simulation inside Teams, Zoom or Meet is not documented either, with Teams and Slack covered as chat messages. Put both in a proof of concept rather than a demo.

• Live conversation
• Cloned voice and video
• Human risk scoring
• Training generation
• Stock library
• Enterprise scale
• Research partial
• Pricing partial
• No orchestration claim
• No meeting delivery claim
• No process testing claim
• Teaches spot-the-deepfake

Evidence, spot-the-deepfake row

Self-serve, simulation-first

Brightside AI

Simulation-first and self-serve, with live AI voice calls, voice cloning and deepfake video alongside email. The live-call-plus-trackable-email hybrid is real sequencing and puts them closer to the orchestrated end than the channel list suggests. Their voice agents are documented as adapting live to what the employee says rather than running a script, which is the harder half of a voice simulation.

Two corrections to our own earlier scoring, made on a re-check on 20 September, and they run in opposite directions. We had credited them with published per-seat rates. We could not substantiate that: there is no pricing page and no rates anywhere on the site, so that mark is now a gap. Against that, we had them at no claim on enterprise scale, which was too harsh. They run a public trust center documenting GDPR, a SOC 2 Type II in progress, and security policies available under NDA, so that mark is now partial. A large regulated deployment still needs the completed SOC 2, and we found no ISO 27001, SCIM or named customers. The Teams-native help desk pretext is not documented.

• Live conversation
• Human risk scoring
• Deepfakes partial
• Training generation partial
• Stock library partial
• Enterprise scale partial
• No orchestration claim
• No meeting delivery claim
• No process testing claim
• No first-party research
• No published pricing
• Teaches tells, favours verification

Evidence, enterprise scale

Process testing and impersonation defense

Doppel

This entry has changed materially since we first published this roundup, and the change runs in their favour. Our August assessment described a different center of gravity and marked our evaluation criterion as not documented. On a re-check in September they document a help desk mode that tests password reset and MFA re-enrollment procedures, and simulations delivered inside Teams and Zoom meetings. That is procedure testing rather than click counting, and it is the closest thing in this set to how we think the category should be measured.

They also publish named threat actor research from their own telemetry and carry the deepest compliance stack in this set, with SOC 2, ISO 27001, 27701 and 42001. Their published framing is worth quoting fairly: their pages are titled around recognizing deepfakes, but the mechanism they describe is rehearsing the seconds after the employee picks up, repeatedly and at increasing difficulty, to build a verification reflex that holds under social pressure. That is a procedural argument wearing a perceptual headline, and we agree with the substance of it. Branch logic between stages is still not stated, and pricing is demo-request only.

• Live conversation
• Teams, Zoom or Meet
• Process testing
• Human risk scoring
• Training generation
• First-party research
• Enterprise scale
• Orchestration partial
• Deepfakes partial
• Stock library partial
• No published pricing
• Recognition framing, procedural mechanism

Evidence, spot-the-deepfake row

Behaviour change at scale

Hoxhunt

The most credible deepfake capability among the large behaviour-change platforms, and the largest published research sample in this set, drawn from its own simulation volume rather than curated from elsewhere. Enterprise scale is not in question: millions of users, 129 or more countries, SSO, SCIM and multi-tenancy.

Two things to check. The meeting experience is documented as a simulated meeting window rather than a real call, and video scenarios are pre-scripted even though voice agents respond in real time. Measurement is per-user click and report behaviour, which is a genuine strength if human risk management is what you are buying, and a gap if you need to know whether a procedure held.

On the detection question they sit in both camps, and the better half deserves credit. They publish a spot-the-deepfake chart built on lighting, artifacting, lip-sync, blinking and skin texture, which is the decaying half. They also publish explicit process boundaries for high-risk workflows: never approve an urgent wire transfer or bank-detail change on a live call, never share credentials over voice, verify unexpected executive messages out of band. That second half is the durable guidance, and it is closer to our position than the first half is far from it.

• Live conversation
• Cloned voice and video
• Human risk scoring
• Stock library
• First-party research
• Enterprise scale
• Meeting delivery partial
• Process testing partial
• Training generation partial
• No orchestration claim
• No published pricing
• Teaches spot-the-deepfake

Evidence, process testing and spot-the-deepfake

AI-native, federal-ready

Jericho Security

AI-native phishing generation with synthetic voice cloning, face-swap video and synthetic personas, sold self-serve across three published tiers. Training generation is a real strength: courses are generated from a topic or an uploaded policy document, with SCORM and xAPI export and a stated turnaround on custom video. Campaign tailoring is genuinely granular, customising subject line, requested information, name, company and department per recipient.

The distinguishing asset is federal procurement. They publish a US Department of War IL5 authorization and NASA SEWP V availability, which matters more than any feature row if you are buying on a government vehicle.

Their campaign page is also the clearest illustration of a distinction worth carrying into every vendor call. Depth of personalisation is not the same as orchestration. Tailoring the subject line, the requested information, the name, the company and the department makes stage one more convincing. Orchestration is what stage two does differently because of what the target did at stage one. A platform can be excellent at the first and have none of the second, and the report will read the same either way. Against our one criterion, sequenced Teams help desk impersonation with a live two-way conversation is not documented. The conversational claim describes back-and-forth email rather than a live agent, and the one staged follow-up description we found sits in press coverage rather than product documentation, so we scored it as not documented.

• Cloned voice and video
• Training generation
• Enterprise scale
• Human risk scoring partial
• Stock library partial
• Pricing partial
• No orchestration claim
• No live conversation claim
• No meeting delivery claim
• No process testing claim
• No first-party research
• Teaches spot-the-deepfake

Evidence, orchestration

Already on a traditional email-first awareness platform? Assume it does not run this chain, and hold it to the same criterion.

Twelve criteria, seven options, scored on public evidence

Now the same six vendors, criterion by criterion. Each cell records what the vendor publicly documents as of September 2026, checked against their own product pages, pricing pages and published research. A blank cell means we could not find a public claim, which is not the same as the capability being absent. Several of these vendors gate their product documentation behind a login or a demo.

Columns follow the same order as the write-ups above. The order is not a ranking, and the row count a vendor leads on is not a score. Read the rows that matter to your program and ignore the rest.

• ● Documented
• ◐ Partial, or documented with a material caveat
• ○ No public claim found

Compiled from each vendor's public website in September 2026. We are one of the seven columns, so read our column with that in mind, and verify any row that decides your shortlist directly with the vendor. Capability behind a login is real capability, it is simply not something we can check. If you represent a vendor listed here and a cell is wrong or out of date, tell us and we will correct it.

The part that undercuts this article

Now the uncomfortable part, and it applies to every column above including our own. Across our engagements, the platform an organization runs has not predicted how it performs. Run the same voicemail and callback technique across different organizations and the action rate ranges from 0% to 34.5% of the targeted population in each engagement. One population had nobody take the action. Another had roughly one in three. They were buying from the same short list.

The vendor is not the variable that moves the outcome. What correlates is whether a verification procedure exists and holds under pressure: whether the help desk can say no to an executive, whether people were told what to do rather than what to spot. You run this evaluation because you cannot fix a failure you have never observed, not because the tool is the fix.

A control built on perception is a countdown. A control built on procedure is not.

That is the whole argument, and it is worth being precise about it, because the compressed version gets it wrong. We are not against detection. We are against locating detection in human perception.

Machine verification is a different matter, and we are firmly for it, particularly in the hiring and identity path: document verification, liveness, validation against authoritative sources, synthetic media detection on the interview channel, and a hard gate before provisioning. Our role is to test whether those controls hold, not to sell them or dismiss them.

How to run the evaluation

Bring these five steps to every vendor, including us. They will tell you which platform can run the modern threat, regardless of how the marketing positions it.

• Use the scorecard to get to three. It is a shortlisting aid, and it rewards documentation quality as much as capability.
• Use the scenario to get to one. Same population, same terminal action, same report format, run by each finalist.
• Ask every finalist for a peer benchmark with a stated number of organizations behind it. Including us.

One last thing, because this argument gets flattened

Compressed into a headline, everything above turns into "detection training does not work." That is not the argument, and we would rather be held to the precise version.

Detection-based training is fine for legacy vectors. Email, sender domains, headers, link destinations, lookalike and homoglyph domains, attachment types, the shape of a payment request that does not match a known pattern. For all of those, teaching people what to look at is sound, it is measurable, and it still earns its budget. The evidence sits still. A person can hover, expand the header, compare the domain against the real one, and check again tomorrow. A skill like that does not expire when a model ships.

It is the wrong control for deepfakes. Synthetic voice and video move the tell from something inspectable to something perceptual, and they move the decision into a live conversation where there is no inspection window at all. The target is not examining an artifact, they are talking to someone. Every tell taught today is a defect in the current generation of synthesis, being engineered out on a release curve the buyer does not control, so the training is worth less the day after it is delivered.

So the rule we apply, and the one we would hold any vendor to, is not "detection or process." It is detection where the tell is inspectable, procedure where it is perceptual. Those are different controls for different vectors, and a program that runs both in the right places is stronger than one that picks a side.

The same distinction is why we are firmly in favour of machine verification, which is detection of a different kind and does not decay the same way. Document verification, liveness, validation against authoritative sources and a hard gate before provisioning all belong in the hiring and identity path. Our job is to test whether those controls hold, not to sell them or dismiss them.

Detection where the tell is inspectable. Procedure where it is perceptual.

“Kudos to your entire team. We haven't even seen the report and the whole company is talking about the risks of voice cloning. It's been a huge win for us already.”

Frequently asked questions