Breacher.ai has announced the general availability of the OSES™ AI Vishing Simulator, a self-run voice phishing platform that places real phone calls to employees, help desks, and voicemail systems using an agentic AI voice agent capable of holding live conversations. The tool is available now and starts at $199 a month.
The announcement matters because the telephone has quietly become one of the most effective ways into an enterprise, and most organizations have no evidence their defenses hold against it. Mandiant's M-Trends 2026 report found voice phishing accounted for 11 percent of intrusions in its 2025 investigations, making it the second most common initial infection vector, ahead of email phishing at 6 percent. CrowdStrike's 2025 Global Threat Report recorded a 442 percent rise in vishing between the first and second halves of 2024.
Unlike email, a phone call arrives with no gateway, link scanner, or reputation score in front of it. The verification procedure is the only control in the path, and according to Breacher.ai, most organizations have never tested whether that procedure survives contact with someone on the line who pushes back.
The simulator consolidates seven capabilities: real calls on live phone lines rather than recordings; outbound calls posing as IT support, an executive, or a vendor; inbound calls to the service desk requesting password resets, MFA re-enrolment, or account changes; voicemail drops that set up a callback answered live by the same persona; deepfake voice using synthetic audio or a consented clone of a real executive; agentic AI that listens, adapts, and handles objections; and prompt-built pretexts written in plain language or pasted from a reported vishing call.
"The phone call is now the front door, and the person who answers it is working without a filter, a gateway, or a second opinion," said Jason Thatcher, Founder and CEO of Breacher.ai. "AI agents can already hold that conversation at scale. The only way to know whether your verification procedure holds is to call it the way an adversary would."
Security teams run campaigns themselves by writing a pretext as a prompt, selecting a synthetic or consented cloned voice, and launching calls against users synced from Microsoft Entra ID or Google Workspace, with no endpoint agent or phone system changes required. Results feed into the OSES™ Risk Score, which records how far the worst call progressed and how widely calls succeeded across the organization, benchmarked against the customer's sector.
The product also embeds safeguards that address the obvious ethical risks of deepfake simulation. Executive voices are cloned only with the consent of the person being cloned, confirmed by a biometric check and voice verification, and an administrator cannot authorize cloning someone else. Campaigns run under signed authorization, call recording is configured to the consent rules of each jurisdiction in scope, and reporting is organizational, with no named individuals.
The implication for security leaders is a shift in how human risk gets measured. Organizations that want email, SMS, QR, Microsoft Teams, and live video avatars orchestrated alongside voice can move to the full OSES™ Platform and retain their Risk Score baseline, and Breacher.ai offers managed delivery for teams that prefer the simulator be run for them.
