Deepfake Phishing Simulations

Show your team how convincing AI voice cloning has become with a hands-on voice deepfake exercise embedded in a training.

Overview

Attackers can now clone a voice from just a few seconds of audio and use it to impersonate an executive or coworker over the phone. The most effective way to build resistance is to let people experience it safely — hearing their own voice cloned by AI is far more memorable than reading about the threat.

Herd delivers this as a Voice Deepfake step inside a training. Rather than a standalone campaign, you drop the exercise into any training you build, alongside info, quiz, and phishing steps.

How the exercise works

When a user reaches a Voice Deepfake step in a training:

1. They're asked to record a short voice message (5–10 seconds) using Slack's built-in audio recording.

2. Herd clones the recording with AI voice-cloning technology.

3. The user is played both samples — their original recording and the AI clone — and asked to identify which is which.

4. Whatever they choose, the step closes with the lesson: AI can clone a voice from seconds of audio, so when a call feels off, verify through a trusted channel.

Adding a Voice Deepfake step to a training

In the training step editor, add a step and choose Voice Deepfake ("Clone the user's voice with AI"). You can customize the instruction, processing, comparison, and follow-up messages, as well as the text the cloned voice speaks. See Creating Trainings for the full training builder walkthrough.

Choosing an attack vector

The step editor's Attack Vector selector picks the scenario the exercise dramatizes, prefilling all the step messages with matching copy (which you can then edit):

• IT help desk password reset (the default) — an attacker impersonates IT support and pressures the target into revealing their credentials.

• CEO fraudulent payment (finance / accounts receivable) — an attacker deepfakes the CEO's voice to pressure a financial controller or AR team member into approving an urgent, confidential wire transfer. The closing lesson: always verify urgent payment requests through a separate, trusted channel.

Voice Deepfake steps are delivered through Slack, so your workspace needs the Slack integration connected. They're also a plan-gated feature — if you don't see the option in the step editor, contact your Herd representative.

Related

• Make Simulations Challenging but Fair — guidance on running higher-pressure simulations responsibly.