Breacher.ai Launches AI Vishing Simulator to Test Human Firewalls

Security teams now have a new tool to test whether their employees and procedures can withstand voice phishing attacks. Breacher.ai announced the general availability of the OSES™ AI Vishing Simulator, a self-run platform that uses agentic AI to make real phone calls to employees, help desks, and voicemails, holding live conversations to simulate real-world vishing attempts.

The timing matters. According to Mandiant's M-Trends 2026 report, voice phishing accounted for 11 percent of intrusions in its 2025 investigations, making it the second most common initial infection vector, ahead of email phishing at 6 percent. CrowdStrike's 2025 Global Threat Report recorded a 442 percent rise in vishing between the first and second halves of 2024. Unlike email, a phone call reaches an employee with no email gateway, link scanner, or reputation score in front of it. The verification procedure is the only control, and most organizations have never tested whether it holds when someone on the line pushes back.

The OSES™ AI Vishing Simulator combines seven capabilities: real phone calls on live lines; outbound calls posing as IT support, an executive, or a vendor; inbound calls to the service desk requesting password resets or MFA re-enrolment; voicemail drops that set up a callback answered live by the agent; deepfake voice using synthetic or consented cloned voices; agentic AI that listens, adapts, and handles objections; and prompt-built pretexts described in plain language.

"The phone call is now the front door, and the person who answers it is working without a filter, a gateway, or a second opinion," said Jason Thatcher, Founder and CEO of Breacher.ai. "AI agents can already hold that conversation at scale. The only way to know whether your verification procedure holds is to call it the way an adversary would. We built the simulator so any security team can do that this month, not next budget cycle."

Security teams run the simulator in four steps: write the pretext as a prompt, choose a synthetic or consented cloned voice, and launch calls against users synced from Microsoft Entra ID or Google Workspace, with no endpoint agent and no phone system changes. Every call rolls into the OSES™ Risk Score, which records how far the worst call progressed (DEPTH) and how widely calls succeeded across the organization (SPREAD), benchmarked against the customer's sector.

Safeguards are built in. Executive voices are cloned only with consent, confirmed by a biometric check and voice verification, and an administrator cannot authorize cloning someone else. Every campaign runs under signed authorization, call recording is configured to the consent rules of each jurisdiction in scope, and reporting is organizational, with no named individuals.

The simulator is available now starting at $199 a month. Organizations that want email, SMS, QR, Microsoft Teams, and live video avatars orchestrated alongside voice can move to the full OSES™ Platform and keep their OSES™ Risk Score baseline. Breacher.ai also offers managed delivery for teams that want the simulator run for them.

For Texas businesses, the launch underscores a shift in cybersecurity priorities. As voice-based social engineering grows, companies that rely on help desks and phone-based verification must validate those procedures or risk becoming the next statistic. The simulator offers a way to measure human and process risk before attackers do.