Email filters have gotten good. Snow Carruthers, who leads the human threats team at Coalfire, remembers when her phishing campaigns landed a 50% click rate. Today the average sits closer to 5–10%, and she credits years of better technology and training for the drop.
Attackers noticed too, so they’ve moved to the channels that are harder to filter: the phone, the text message, and increasingly, a convincing face on a video call. Generative AI is making every one of those channels cheaper, faster, and more believable.
In our recent Fable Fireside with Coalfire, Fable Field CISO Jacob Berry sat down with Snow, who has spent 15 years breaking into organizations for a living (and completed more than 225 physical assessments without once ending up in handcuffs), to talk about what’s actually working for attackers right now.
Watch the full conversation
In 45 minutes, Jacob and Snow covered:
- How social engineering evolved from 1980s phone phreaking to today’s AI-assisted campaigns, and why the playbook hasn’t changed as much as you’d think
- Real war stories from the field, including a help desk attack that succeeded on the second call
- What happened when Snow pitted human social engineers against AI, in both phishing emails and live phone calls
- Why deepfake video has suddenly become a viable attack channel, and the simple trick that still breaks it
- Practical best practices for verification and building a culture where it’s okay to pause
Three things that stuck with me
1. The help desk is the front door
Jacob shared a vishing pattern he’s heard from several customers in recent months. An attacker calls the help desk asking for a password reset, fails the verification check, and hangs up. They immediately call HR, ask for their “forgotten” employee ID, and then call the help desk back with the missing piece. Snow’s response was that her team does exactly this all the time, and it works. Successful vishing is rarely one call; it’s a series of small, harmless-sounding conversations.
2. AI is closing the gap with human attackers
Snow ran an A/B test where half an organization received a phishing email written by her team and half received one written by AI. The organization’s baseline click rate was 8%. The AI email hit 11%, and the human-crafted email hit 14%. A similar head-to-head with live phone calls ended the same way, with humans winning by a hair. Both tests are a couple of years old, and as Snow put it, AI improves every week. Jacob added that customers report employees who “will basically do anything the robot says” when it calls them.
3. Deepfakes made video an attack channel overnight
A few years ago, Snow’s team would smear Vaseline on a webcam to get past video verification. Now a convincing deepfake takes seconds, and both speakers are hearing first-hand stories of attackers joining Teams calls with a trusted face. If you want to see how easy it is, ask our team to show you the Fable AI Studio!
Test your phone channel before an attacker does
Snow’s prediction is that phone-based attacks will keep climbing, because there are so few technical controls standing between an attacker and someone who picks up. Policies help, but her team still regularly talks help desk staff into password resets and MFA changes they shouldn’t make. The only way to know how your people respond under pressure is to put them in that moment.
This is where Fable and Coalfire can help, together.
Fable’s AI vishing simulations let security teams test phone workflows continuously and at scale. You use authorized deepfake voices to place realistic calls to help desks and other shared lines, and you get the full transcript and evidence from every call. Results flow into the same Fable platform you use to detect risky behavior, coach people in the moment, and measure whether behavior actually changes.
Coalfire’s human threats team, led by Snow, brings the expert-led side: phishing, vishing, SMS, and physical assessments that mirror how skilled attackers research and chain together multi-channel campaigns. Pairing the two gives you ongoing, measurable practice for your people and a realistic view of how a determined adversary would get in.