Vishing simulation guide

Vishing simulation: what it is and how to run one

A vishing simulation is an authorized phone call that imitates a voice phishing attack to see whether employees give up passwords, codes or data. To run one, get written approval, pick a pretext, load your targets, place the calls, then review the recordings and results by department. With vishin.ai an AI voice agent places the calls and you pay per call.

By . Published . Last updated .

Key takeaways

  • A vishing simulation is an authorized phone call that tests whether employees give up credentials, codes or data.
  • Measure four things: what was disclosed, whether the caller was verified, how the person handled pressure, and whether they reported it.
  • Get written approval before any call, and settle recording rules for every state involved.
  • AI voice agents play the same character on every call and scale past what human callers can do.
  • vishin.ai charges per call: 5 tokens a call, tokens from $1, no subscription.

A security team or its vendor places the call, and the caller plays a believable role such as an IT help desk agent, a payroll clerk or a vendor. The caller tries to get the employee to hand over something they should not: a password, an MFA code, an employee ID, or a click on a link. Nothing is actually stolen. The point is to learn how people behave on a real call, then train them where the gaps are.

CISA describes vishing as social engineering that uses voice communication, and notes that internet phone services make it easy to spoof who is calling. Email phishing tests are common. Phone tests are not, and attackers know it. A call puts a live human on the line, adds time pressure and leaves no link to hover over. That makes it a different skill to defend against, and it is hard to test with email tools alone.

What a vishing simulation measures

  • Information disclosed. Did the person give a credential, an employee ID, a system name or an org chart detail?
  • Verification behavior. Did they try to confirm who was calling, for example by asking for a callback number or hanging up and dialing the help desk themselves?
  • Pressure response. Did urgency, authority or fear override what they were trained to do?
  • Reporting. Did they tell security about the call afterward?

Those four signals tell you more than a single pass or fail. A person who refuses to share a password but still confirms their manager's name has leaked something useful to a real attacker.

Common vishing pretexts

Good scenarios copy what attackers actually do. The most common pretexts are:

  • IT help desk. A password reset, an MFA enrollment problem or "suspicious activity on your account".
  • HR and benefits. Open enrollment changes, a payroll discrepancy or a tax form update.
  • Executive request. An urgent wire transfer or a confidential directive.
  • Vendor or supplier. An invoice dispute or a change of payment details.
  • Bank or fraud team. A fraud alert or an account verification.

Each one leans on a familiar pressure point: authority, urgency, fear, or the wish to be helpful. The scenario you write decides which one is tested. The help desk pretext is also the one real attackers favor: a CISA and FBI advisory reports Scattered Spider actors phoning IT help desks to get passwords reset and MFA tokens transferred.

AI voice calls versus human callers

Vishing assessments have traditionally been run by a person with a script. That works, but it is slow and does not scale past a handful of calls, and results vary with who is calling. An AI voice agent plays the same character on every call, handles pushback in real time instead of reading a fixed script, and can place many calls without hiring callers. It also records and transcribes each one automatically.

vishin.ai uses AI voice agents for this reason. You define the pretext, the caller's name and backstory, the objectives and what counts as a failure. The agent does the rest.

How to run a vishing simulation

  1. Get written authorization. Before any call, an authorized person at the organization approves the test in writing, including scope and rules of engagement. See is vishing testing legal? for the consent and recording issues to settle first.
  2. Choose a pretext and objectives. Pick one scenario, such as an IT help desk reset, and decide what a failure looks like: sharing a password, reading out an MFA code, or confirming an employee ID.
  3. Import your targets. Load a list with names, titles, departments and phone numbers so the caller can address people correctly and you can compare departments later.
  4. Run the campaign. The AI caller phones each target, holds a live conversation and records it.
  5. Review the results. Read the transcripts, check the suggested pass or fail verdicts and look at risk by department.
  6. Train and retest. Aim awareness training at the groups that struggled, then run the same scenario again to see if behavior changed.

The same workflow applies whether you are an internal security team or a consultant testing a client. NIST's testing guide says social engineering tests should be used to improve an organization's security, not to single out individuals, and that the final report should cover both the tactics that worked and the ones that did not. The assessment guide covers the consultant version in more detail.

What you get back from each call

In vishin.ai each call produces a recording, a transcript, a pass or fail result and a risk score. Results roll up by department so you can see where training should start. You can export campaign results to CSV for your own reporting.

Pricing: pay per call, not per seat

Many security awareness platforms sell annual per-seat licenses. vishin.ai charges per call instead. A call costs 5 tokens, and tokens start at $1 each, with packs from $10 and discounts of up to 15% on larger packs. Tokens do not expire, and there are no limits on campaigns, targets, users or scenarios. Calls that fail for a technical reason, such as a carrier failure or a voice provider error, are not charged; calls that go unanswered or reach voicemail are. See the pricing page for the current packs, or the KnowBe4 comparison if you are weighing a seat license.

Frequently asked questions

Is a vishing simulation legal?

It can be, when it is authorized and run within the law, but recording rules vary by state and you are responsible for following them. Read is vishing testing legal? for the details. This is general information, not legal advice.

How many calls do I need?

It depends on the question. A pilot of a few calls shows whether a scenario works. A broad assessment calls every in-scope employee or a representative sample from each department.

Will employees know it is a test?

Not during the call, which is the point. Plan the debrief ahead of time. The goal is to teach, not to punish, and results should be handled that way.

What is the difference between vishing and phishing?

Phishing uses email or text messages. Vishing uses a voice call. The psychological levers are the same, but a live call adds real-time pressure and leaves no link or sender address to inspect.

Sources