B eache .ai lau ches IT suppo t impe so atio assessme t as voice phishi g ove takes email as the way i to the E te p ise
Most voice testi g measu es the outbou d call. B eache .ai measu es the voicemail a d the callback, whe e the most co seque tial outcomes occu , a d etu s a OSES™ isk sco e be chma ked agai st the o ga izatio ‘s pee ve tical.
Most people do ‘t a swe , so the voicemail goes out a d a po tio of them i g the umbe back. That callback is whe e the wo st outcomes happe , a d the easo we built OSES™
Ma dia t’s M-T e ds 2026, d aw f om mo e tha 500,000 hou s of i cide t espo se i vestigatio s fou d highly i te active voice phishi g had ise to o e of the top i itial i fectio vecto s, the seco d most commo ove all, while email phishi g fell ove all.
The 2026 b each eco d has followed the data. A telecommu icatio s ope ato , a ide tity p otectio p ovide a d a etwo ki g ve do each disclosed la ge-scale custome data exposu e o igi ati g f om voice phishi g calls.
B eache .ai’s assessme t eplicates that seque ce. A auto omous AI voice age t calls employees as thei i te al IT suppo t desk. Whe e a call goes u a swe ed it leaves a voicemail with a callback umbe , a d whe the employee i gs back the age t a swe s a d holds the co ve satio live.
Voice clo i g of a amed i dividual is available whe e the custome wa ts it tested a d co se t fo the like ess is docume ted. Testi g of the o ga izatio ‘s ow se vice desk ecove y p ocedu e is available as well.
The assessme t is offe ed as a ma aged se vice, with o subsc iptio a d o commitme t. It o igi ates e ti ely outside the custome ‘s e vi o me t a d equi es o softwa e, i teg atio o access to i te al systems. It cove s i itial access o ly; o emote access tooli g is deployed, o late al moveme t is attempted a d o custome data is touched.
Why the p etext wo ks“Email secu ity got bette . Huma voices did ot get easie to dist ust,” said Jaso Thatche , fou de a d chief executive of B eache .ai. “Attacke s moved to the cha el whe e the automated co t ols you bought do ‘t ope ate.”
B eache .ai also epo ts that the tech ique does ot equi e sy thetic media to succeed. Amo g the most effective campaig s i the compa y’s e gageme t book a e u s usi g a co ve satio al AI voice age t with o clo ed voice at all.
“T ai i g matte s a d eve y o ga izatio should be u i g it. What it ca ‘t do is ca y this o its ow ,” Thatche said. “Detectio ability decays as ge e atio quality imp oves. P ocedu al ve ificatio does ‘t. The questio is ‘t whethe you people ca hea that a voice is sy thetic, it’s whethe you p ocess holds whe they ca ‘t, a d that’s a questio you a swe with testi g athe tha with a cou se.”
Measu i g the full seque ce: B eache .ai’s data i dicates that measu i g o ly the outbou d call disca ds the majo ity of the sample. Because most ta gets do ot a swe , the voicemail-a d-callback path is the domi a t oute th ough a populatio athe tha a edge case, a d the i bou d callback is whe e the compa y obse ves the most co seque tial esults: a st uctu al effect, si ce the employee i itiated the co tact a d the efo e has o cold ope a d o easo fo suspicio .
Results a e sco ed usi g OSES™ (O chest ated Social E gi ee i g Simulatio ), B eache .ai’s p op ieta y measu eme t model. Sco i g is based o a escalatio ladde at the deepest poi t they campaig eached ac oss all legs a d both di ectio s: o actio , small e gageme t, click, co ve satio al e gageme t, actio take , o a co seque tial escalatio dow st eam.
Sco es a e ba ded Low, Medium, High o C itical.Small g oups withi a oste a e epo ted as eve ts athe tha ates. “O e pe so ha di g ove a ide tity is the fi di g,” Thatche said. “It does ‘t eed a de omi ato , a d putti g a pe ce tage o th ee people would be disho est.”
Thatche also poi ts to the speed at which a si gle pho e call becomes a i cide t. Ma dia t measu ed the media ha d-off betwee i itial access a d a seco d th eat acto collapsi g f om oughly eight hou s i 2022 to 22 seco ds. “The e is o ealistic wi dow i which somebody epo ts the call i time,” he said. “That’s why the co t ol has to be the p ocess, ot the pe so otici g afte wa ds.”
Be chma ki g agai st pee sThe compa y positio s the pee ve tical compa iso , ot the aw sco e, as the p ima y delive able, a d otes that it matte s mo e fo this tech ique tha most, because the c ews u i g it wo k o e secto at a time.
“K owi g that 14% of you people complied tells you othi g o its ow ,” Thatche said. “It does ‘t tell you whethe you’ e the soft ta get i a secto someo e is about to wo k th ough. That’s the epo t that matte s: you sco ed X, you pee ve tical sco es Y, a d he e’s the specific behavio that moved you off the media .”
Delive ables i clude the OSES isk sco e with DEPTH a d SPREAD epo ted sepa ately, the pee ve tical positio , amed p ocess failu es ide tifyi g the ve ificatio step that should have i te upted the call, a pe -leg b eakdow ca yi g its ow de omi ato s, a d p ocedu al ecomme datio s w itte agai st the custome ‘s ow policy.
The assessme t is available immediately at https://b eache .ai/se vices/ai-voice-phishi g-assessme t/.
B eache .ai builds a d ope ates OSES™, a o chest ated social e gi ee i g simulatio platfo m used by majo o ga izatio s, to test how o ga izatio s behave u de AI-d ive voice, video a d messagi g. Fou ded a d u by secu ity p actitio e s, the compa y was amo g the fi st e t a ts i deepfake social e gi ee i g simulatio a d mai tai s o e of the field’s la ge i depe de t be chma k datasets.
B eache .ai’s positio is that huma detectio of sy thetic media ca ot ca y the defe se, a d that the du able, measu able laye is p ocess, policy a d p ocedu e alo gside t ai i g.
The compa y is based i O la do, Flo ida.
# # #
