Over the past few months, we’ve watched attackers go after major financial and legal firms through one channel more than any other: the phone (source: 1, 2). They’re using AI agents to place voice phishing calls at machine speed, with cloned voices that sound like a colleague, a vendor or the CFO. Most employees can no longer tell whether the caller is AI or a real person. And most security teams have nothing in place to test or train for it.
Here’s what one of those calls sounded like. In August, attackers went after some of the biggest hedge funds in the world. Employees got a call on their personal cell phones, from a number that looked like their own help desk. The caller said they were from IT – “there’s an urgent, mandatory migration, and you need to log in to the new system now”. The login page was in fact a fake credential harvesting page. Once in, the attackers went straight for data in Microsoft 365 and Okta (source: 3).
The conversations probably sounded a little bit like the example below. In this scenario, our AI agent is acting the the attackers did during the hedge fund attacks. The employee on the other end has a few seconds to decide. Would they stop long enough to sense that something is off? What do you think your employees would do?
Today, Fable is launching vishing simulations, which give your people a chance to practice those scenarios before it counts. We place the kind of call an attacker would. If someone goes along with it, they get coached on the verification step they skipped, and your security team learns who needs help most.
The phone is the new front door
Recently, some of the best-defended companies in the world have been breached by a phone call. Not some crazy zero-day exploit, just… a conversation. They come in all shapes and sizes:
- An impersonated employee asks the help desk for a password reset.
- A fake vendor asks accounts payable to update banking details.
- A cloned executive voice pushes an urgent wire through.
CrowdStrike reported that vishing intrusions doubled in the first half of 2026 compared to the second half of 2025. Voice cloning is now cheap. Sounding like your CFO takes $6.
Technical controls only go so far. Attackers target people whose job is to pick up and help: the service desk, salespeople, partner managers – not picking up the call is not an option. What stops the attacker is a verification step – the most important and hardest part – followed under pressure.
People naturally want to help. The only way for them to consistently follow the verification process under pressure is to practice it.
What we’re launching
Fable AI vishing simulations call your people the way an attacker would. We call using voices that you authorize. These aren’t recordings. The caller listens and adapts. When the recipient pushes back, the AI caller pushes back too. Ask about the weather or for a joke, and it plays along, the way a real person would. That’s what makes it convincing – attackers already use this technique to sound convincing, and now your employees get to experience and learn from it in a safe environment.
We are launching with pretexts sourced from real-world attacks: the locked-out executive, the vendor with new bank details, the help desk tech who needs remote access. You can start from more than 50 of them or write your own with a few prompts.
Here’s how it works:
- A real call to the lines attackers target. Point it at your service desk, your AP line or your executive assistants. You select the scenario, choose the voice and tell the agent what the simulation objective is.
- Right-sized coaching. If someone complies, the caller ends the test with a short reveal. Then the AI coaches them on that specific call: what they did, where it went wrong and the verification step that would have stopped it.
- A new risk signal. Every call feeds that person’s and team’s risk profile, next to their authentication posture, data handling, awareness and more. You see who needs help most, and get a full transcript that supervisors can use to train their teams on exactly where they fall short.
Watch one of our SEs build and test out a whole vishing scenario within a few minutes:
From a test to a program
A single vishing test tells you who said yes on one call. Fable makes vishing susceptibility part of how we assess who your riskiest people are, why they’re risky, and whether they’re getting better over time. That allows you to have confidence that your organization is actually safer.
- Who is most likely to be targeted? For example, which of your people a group like ShinyHunters would go after first, based on their role, their access and how exposed their contact details are.
- Who would actually fall for it? Vishing results sit next to everything else Fable sees about that person, from authentication posture to data handling, so you know who needs the most help.
- How do you know they’re safe now? After Fable’s follow-up, you can see whether that person holds the line on the next call, and report that trend to your leadership and auditors.
With Fable’s ability to identify the highest-risk people across multiple vectors and proactively reach them to reduce their risk, AI vishing adds a rich set of signals on who is vulnerable to voice-based social engineering threats that are rising quickly today.
For your most critical people, our expert red team runs human-led vishing engagements, including multi-channel scenarios that chain voice with email or chat.
The result is a full-fledged human risk management program, and the assurance that your most at-risk people have adapted their defense to keep themselves and your organization safe.
What security leaders are saying
“It’s amazing how realistic that sounds. It’s convincing, and that’s what’s scary. That’s exactly the kind of call our people need to be ready for.”
- Manuel Bernal, VP of Technology, Greylock
“Vishing simulation is exactly what we needed. I’m excited to get hands-on, and I’m 100% putting it to work right away.”
- Aneela Prasad, Sr. Cybersecurity Strategy & Engagement Analyst, DFW
At Dayton Children’s Hospital, CISO Nick Schopperth used Fable to run a targeted vishing intervention for the service desk, the team most likely to get that urgent reset call.
See this in a live with us (the founders)
I’ll be hosting a live webinar with my cofounder and Fable CEO, Nicole Jiang, on Tuesday, Nov 17 at 12pm PT to share more on what we are launching. We’ll cover:
- A full demo of vishing simulations
- How results flow into the closed loop
- What’s next on the roadmap
- How multi-channel attacks are changing the way teams prepare
- And some of our favorite easter eggs
Come join us and bring questions. Register here.
Rather talk now? Book time with a Fable vishing expert. You’ll test a live simulation and learn which of your workflows attackers are most likely to target.
Sources:
1. Fortune, “Major hedge funds targeted in wave of attempted cyberattacks,” Aug 6, 2026
2. Mandiant, Google Threat Intelligence Group, “Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms,” Jun 5, 2026
3. CrowdStrike, “2026 Threat Hunting Report,” Aug 3, 2026