Every security team knows the rhythm. A threat report lands describing a fresh social engineering campaign: a new help desk pretext, an IT support script running over Microsoft Teams, a deepfake executive joining a video call. The team reads it, forwards it, and then waits. The simulation that would show whether their own people and procedures hold against that exact play arrives next quarter, if it arrives at all, as a catalog template written for somebody else’s company.

We run orchestrated social engineering simulations for enterprise organizations, and closing that gap is the reason we built the AI Concierge. It turns a description of a modern threat into a finished, threat-informed simulation in minutes, so your program moves at the speed of the adversary instead of the speed of a content release schedule.

What is a threat-informed phishing simulation?

The two halves of that definition carry equal weight. The first half keeps the simulation current. The second half keeps it useful, because the question a security leader actually needs answered is not whether someone clicked. It is whether the consequential action the adversary wanted, a payment, a credential reset, a remote access session, was stopped by a verification step.

Why template libraries fall behind the threat

Template libraries were built for a world where phishing meant one email and one click. Modern social engineering outgrew that world in four specific ways.

How the AI Concierge builds a simulation from a modern threat

The AI Concierge starts with the threat you are worried about. Type it in plain language, or drop in the article, advisory or threat report that describes it, and the Concierge assembles everything behind it.

Seven modern threats you can simulate this week

These are the patterns showing up in current threat reporting and in our own engagements. Each one becomes a working simulation from a single Concierge request, and each one is aimed at a specific procedure.

For the deepfake meeting row, our ranked list of deepfake attack examples shows how that play has run against real organizations. For the hiring row, the strongest programs pair a trained procedure with technical identity verification, such as document checks, liveness and validation against authoritative sources, and the simulation tests whether that whole gate holds before anyone is provisioned.

Built to test the procedure, not the tell

Threat-informed does not mean chasing the newest artifact. A simulation that only asks whether people noticed this month’s giveaway would be out of date the moment the generators improve. That is why we treat deepfake detection training as a decaying control for synthetic voice and video.

The AI Concierge aims every simulation at the verification step instead. A callback to a known-good number returns the same answer against a crude fake and a perfect one. The control does not read the artifact, so it does not get weaker as the artifact gets better. That is the durable target, and it is where we put the pressure.

A workforce that invokes process defeats our red teams. Spotting fakes does not do that consistently. Invoking the procedure does.

Precise about the claim. A more convincing threat does not break a verification step directly. It raises the pressure to waive it. That is why every simulation records whether the check was attempted, skipped or granted as an exception, and why we report the exception rate rather than claiming any procedure is unbreakable. You can read the full reasoning in verification procedure training over detection.

From simulation to training, the same afternoon

The same threat article that produced the simulation can produce the training. Drop it in once and the platform generates both: the threat-informed phishing simulation and an awareness module written in your terminology, naming your systems and your approval steps. It generates in any language, so global teams get the same current material on the same day.

When the simulation shows that a verification step did not hold, the module a person receives is the procedure they did not follow, routed to the roles that were asked to perform it. Per-person results are a routing input, not a board metric. Then the re-test targets the same control, so you can prove the change. This is the training stage of the Secure Behavior Management platform, introduced in our AI phishing simulation generator launch, and it extends the approach we described in threat intelligence-based awareness training.

What to measure when the threat changes

Click rate tells you very little about a voice callback or a deepfake meeting. These three numbers tell you whether the organization holds, and how you rank against your peers on the OSES™ Risk Index.

Enterprise ready from the first simulation

The AI Concierge runs inside a platform built for enterprise security programs, and it slots into the stack you already own.

• Identity and access. SSO, with Microsoft Entra ID and Google directory integration.
• Automation. REST API, CLI and webhooks for your SIEM, GRC and LMS workflows, plus SCORM export for training modules.
• Assurance. SOC 2 Type I report issued, with the Type II examination underway.
• Microsoft Attack Simulation Training. Breacher.ai augments it through Entra ID, offered now as a free beta, so you can add current voice, chat and video threats without replacing anything.
• Pricing. A flat platform fee by tier, never per seat, so running one more simulation when the next threat lands costs nothing extra.

What we would do first

You can start this today, with or without us.

Measure your risk. Train for what you find. Prove it changed.

Frequently asked questions