OSES™: the white-label phishing simulation engine. Deepfakes included.
Your customers are being targeted by cloned voices, live deepfake video, and AI agents that hold a conversation. Template email simulation was built for a different threat. Put the OSES™ engine behind your awareness platform: white-labeled, driven by API or MCP, and scored on one risk model.
For security awareness training and human risk management companies.
Your customers' adversaries upgraded. Have your simulations?
The threat moved from the inbox to the phone, the meeting, and the help desk, and it now talks back. A simulation layer that cannot follow it there leaves your customers measuring the wrong exposure.
Renewals get harder every time a customer asks what you are doing about deepfakes.
Your platform gets the answer to the deepfake question, under your name.
Every channel your customers are targeted on
The same capability set Breacher.ai uses on its own engagements, available to your platform and your customers.
Calls that talk back
Outbound calls to employees, inbound calls to the help desk, and voicemail drops that set up the callback. An agentic voice agent holds the conversation, in a synthetic voice or a consented clone.
Joins the meeting
A two-way interactive avatar that joins Teams, Zoom, and Meet as a participant and holds a live conversation. It tests whether a familiar face on a call is being treated as proof of identity.
One pretext, every channel
A voicemail, then an SMS, then the call that picks up where both left off. Each step sets up the next, the way a real campaign builds trust before it asks for anything.
The channels you already run
Email, SMS, and QR simulation on the same engine, so they become steps in a sequence instead of standalone tests with their own numbers.
Built from a prompt
Describe the caller, the reason, and the objective in plain language, or paste a threat a customer reported. Pretext, persona, and guardrails come from the prompt, not a fixed library.
Training from what it found
Micro modules generated from each customer's own findings and delivered under your brand, aimed at the exact step that gave way. See OSES™ Behave.
Every channel and scenario type is listed on the full OSES™ capabilities page. The voice channel is also sold on its own as the OSES™ AI Vishing Simulator.
White-label it, call it, or hand it to an agent
Pick the path that fits your product. Most partners use more than one.
Your brand on everything
Your brand on the console, the reports, and every customer-facing deliverable. A parent tenant with a sub-tenant per customer, role-based access for your team, and data separated between accounts. You own the relationship and the renewal.
Drive it from your platform
Create campaigns, sync users, track status, and pull results from inside your own product. Webhook events push outcomes into your reporting, so customers never leave your interface.
Let agents run it
The engine is exposed as a Model Context Protocol server. An AI agent in your product, or your team's own assistant, can build, launch, and read simulations in plain language, under the same authorization controls as the console.
From partner call to your first branded campaign
Four steps. Nothing installs in your customers' environments.
The OSES™ engine, answered
What is the OSES™ simulation engine for partners?
It is the same engine that runs Breacher.ai simulations, offered to security awareness training and human risk management companies under their own brand. Your platform keeps the customer, the curriculum, and the relationship. The engine supplies deepfake voice, live video avatars, orchestrated multi-channel sequences, and outcome scoring on the OSES™ Risk Score.
Is the engine fully white-labeled?
Yes. Your brand goes on the console, the reports, and every customer-facing deliverable, and your customers deal with you, not with us. Each of your customers gets its own sub-tenant under your parent tenant, with data separated between them.
What can the API and the MCP server do?
The REST API lets your platform create campaigns, sync users, track status, and pull results, with webhook events pushed into your own reporting. The MCP server exposes the same engine to AI agents, so an agent inside your product, or your team's own assistant, can build, launch, and read simulations in plain language. Both run under the same authorization and consent controls as the console.
Do we have to replace the simulations we already run?
No. You can put the engine behind the channels your platform does not cover today, such as deepfake voice and live video, or move your whole simulation layer onto it. Partners usually start with voice and deepfake, because that is what their customers are asking about, then consolidate once one score covers every channel.
How are consent and authorization handled?
Every campaign runs under signed authorization from the organization being tested, with named approvers, agreed windows, and abort conditions. Executive voice and likeness are cloned only with the consent of the person being cloned, confirmed by a biometric check and voice verification before anything is generated. An administrator cannot authorize cloning someone else, and none of this relaxes when the engine runs under your brand, through the API, or through the MCP server.
How is partner pricing set?
Partner terms are agreed per partner and differ from our published standard pricing. We set them on the partner call, based on how you deliver and how many customers you put on the engine.
Modernize your simulations before your customers ask why you have not
Thirty minutes. We will map the engine to your platform, walk the API and MCP server, and run a live deepfake simulation end to end.
Want the detail first? See all capabilities or the partner program.
support@breacher.ai
