Voice Simulations
Run AI voice phishing (vishing) simulations that call your team with a realistic pretext, and see who reads a verification code back to a stranger.
Overview
Voice phishing — vishing — is the phone call version of everything your team already practices by email and text. A caller claiming to be the help desk, the CFO, or payroll creates urgency and asks for one small thing: the code that just arrived on your phone. Attackers use AI voices to do this at scale, and it works because a live conversation gives people no time to think.
Herd lets you run that exercise safely. A voice simulation pairs a text message with a phone call:
The person receives a text message with a code in it.
Then their phone rings. An AI voice plays the pretext from the attack type you chose — the help desk confirming a ticket, finance releasing a payment, payroll checking a direct deposit change.
The caller asks them to read the code back.
What they do next is the result:
Reading the code back is a fail. They handed a verification code to someone who called them out of the blue.
Answering the call without reading the code back is a pass, and so is not answering at all.
Each person's outcome is recorded on the campaign's Results tab, so voice sits alongside your email, SMS, and WhatsApp simulations as one more channel your team practices on. Reading the code back is recorded as a failure and raises a high-weight risk event on that person's profile.
What people hear
Calls open with a disclosure, played in Herd's own voice (at 1.2x speed) before the pretext begins, so it never sounds like the caller:
This is a security awareness exercise run by your employer. No account or payment is affected, and the code you were sent is not a real verification code.
Only after that does the AI voice start the scenario. Herd pre-fills that line on every attack type — see Voice Attack Types.
People who opted out of texts are never called. Anyone who has opted out of simulation text messages is excluded from voice campaigns automatically — you don't have to maintain a list.
What You'll Find Here
Before You Start with Voice Simulations: what has to be in place before your first campaign can launch — the channel, the consent attestation, and phone numbers.
Voice Attack Types: the four built-in scenarios, how to write your own, and how attack-type approval works.
Create & Launch a Voice Campaign: pick an attack type, build the audience, choose when to call, and launch.
Voice Campaign Results: what each status means, per-person call history, and why a scheduled launch might not have called anyone.
Managing Voice Campaigns: unscheduling, duplicating, renaming, and what happens when consent is withdrawn.
Voice Simulation Limits: where voice simulations work and where they don't.
Pair voice with email, SMS, and WhatsApp campaigns so your team practices on every channel an attacker will actually use.
Last updated