To choose a deepfake attack simulation platform, compare four things: the meeting experience, who builds the scenarios, the channels covered and what happens after an employee fails. This guide applies those criteria to Arsen, Callstrike, Adaptive Security, Hoxhunt, Frame Security, KnowBe4 and Keepnet, based on what each vendor states on its own site in October 2026.
Key takeaways
- Vendors now differ more by delivery model than by modality: some sell self-serve tools, others build each executive deepfake for you.
- Meeting formats differ: one vendor states it joins live calls, several reproduce the Teams, Meet or Zoom interface in a look-alike meeting, and others generate training videos.
- Check that the simulated meeting matches the tool your executives actually use: Microsoft Teams, Google Meet or Zoom.
- Look for deepfake results in the same report as phishing and vishing, so human risk is measured in one place.
What is a deepfake attack simulation platform?
A deepfake attack simulation platform runs controlled attacks in which an AI-generated likeness of a trusted person, usually an executive, asks an employee to act. The test measures whether the employee pauses and verifies through another channel. It extends the threat model behind vishing and phishing to video. Some vendors also market these tools as deepfake awareness training platforms.
A deepfake is synthetic video or audio that imitates a real person. A simulation is the safe, authorized version of the attack, built so security teams can measure and coach behavior without real losses.
Why are security teams adding deepfake simulations?
Deepfake fraud now produces documented, large losses, and most of them hinge on one person approving a request. Surfshark’s dataset of publicly reported incidents, published in April 2026, counts $2.19 billion in deepfake-related fraud losses between January 2019 and March 2026, with corporate attacks such as CEO impersonation accounting for 25%.
The best-known case remains Arup, where an employee in Hong Kong transferred about $25 million after a video call with deepfakes of senior colleagues, as the World Economic Forum reported in February 2025. Finance and treasury teams face this pattern most often, which is why deepfake fraud in financial services has become a board-level topic. Deepfake detection tools can flag synthetic media on the channels they are plugged into, but they do not tell you whether an employee would have called back before paying.
How to choose a deepfake attack simulation platform
Start from four criteria, then check each vendor against them:
- Meeting experience: does the vendor join live calls, reproduce the Teams, Meet or Zoom interface, or generate a training video?
- Who builds the scenarios: your team in a self-serve tool, the vendor for each campaign, or a done-for-you service you approve?
- Channels: video alone, or chained with email, SMS and voice the way real attackers work?
- Follow-up and reporting: what the employee gets right after failing, and whether deepfake results sit next to phishing and vishing.
Each platform below is described from its own website or press coverage, checked in October 2026. When a vendor does not state something, the table says so. The order of the list is not a ranking.
Arsen
Best for security teams that want realistic executive deepfake calls without building them in-house.
Arsen runs deepfake video call simulations that impersonate your own executives in a pixel-accurate replica of Microsoft Teams, Google Meet or Zoom. Arsen builds the persona, scenario and send schedule for each campaign, and results sit in the same platform and reports as its phishing and vishing simulations.
Callstrike
Best for red teams that want live, operator-run deepfake calls.
Callstrike presents itself as a platform for deepfake attack simulation and training. It states that it can join live Zoom, Microsoft Teams and Google Meet calls as a deepfake of a trusted colleague, and adds voice cloning and AI outbound vishing bots that impersonate executives, IT support or vendors. Campaigns run self-serve from the browser or as a managed service.
Adaptive Security
Best for teams that want deepfakes inside an AI-native awareness platform.
Adaptive Security describes realistic deepfake video and audio simulations alongside email, SMS and voice. Every interaction rolls up into a per-person and per-department risk score, with board reporting.
Learn more about Adaptive Security →
Hoxhunt
Best for Hoxhunt customers that want an executive deepfake in a mock meeting.
Hoxhunt states that it creates a deepfake of one of your executives' likeness and voice for a mock video meeting, customizable to your context. Your admin selects the recipients and launches the scenario, and group-level and individual fail rates are tracked.
Frame Security
Best for enterprises evaluating a newer AI-native human risk platform.
According to SecurityWeek, Frame Security emerged from stealth in May 2026 with $50 million in funding to address AI-driven social engineering. Its simulations include video impersonations of executives or known contacts, audio and video deepfakes of synthetic personas, and voice calls that sound internal, all feeding a Human Risk Score per employee.
Learn more about Frame Security →
KnowBe4 (AIDA deepfake training)
Best for KnowBe4 customers that want a personalized deepfake training module.
KnowBe4 announced custom deepfake training in December 2025. According to its product page, administrators upload a short video and audio sample of a leader, and an AIDA agent generates a deepfake training module featuring that person, used on its own or inside existing training plans. KnowBe4 describes the result as a deepfake training asset.
Keepnet
Best for teams that want multi-channel deepfake scenarios.
In a post on deepfake phishing simulation, Keepnet describes simulations using AI-generated voices, video and avatars, with scripts that can be delivered inside a simulated Zoom or Teams-style video meeting. Reports show pass and fail rates and the personas and channels that convinced employees most.
How does Arsen run deepfake attack simulations?
Arsen runs realistic deepfake video call simulations that impersonate your own executives in a pixel-accurate replica of a Microsoft Teams, Google Meet or Zoom call. They sit in the same platform as Arsen's vishing and advanced phishing simulations, so one program covers voice, video and text, the channels a real attacker chains together.
A typical deepfake executive fraud simulation runs in four steps:
This fake update ending is one scenario among others, chosen because it mirrors a common real attack: the ClickFix prompt at the end of a deepfake call.
Available platforms for deepfake video call simulations:
Microsoft Teams
Google Meet
Zoom- Your own executives, not stock avatars: each deepfake is built around the leaders your employees actually know.
- Custom scenarios for each team: scenarios and environments are built for your company, department or internal profile, from precise payment-approval scenarios for finance teams to broader scenarios that measure risk at scale across larger teams.
- Adaptive awareness lessons: each simulation is paired with adaptive, interactive awareness lessons that build concrete readiness.
- Done-for-you: Arsen builds the persona, the call scenario, the follow-up assets and the send calendar. You approve; you don't build.
- 72-hour exposure baseline: within 72 hours of rollout, you see which departments, executives and employees would fall for a deepfake call.
- Manager follow-up: line managers see who was fooled and follow up directly, so the security team stops chasing every employee.
- One platform, one report: deepfake results share the dashboard and audit trail of your phishing and vishing simulations, with compliance-ready, board-level reporting.
Learn more about deepfake simulation →
How do these deepfake simulation platforms compare?
| Platform | Video | Voice | Meeting format | Delivery | Reporting |
|---|---|---|---|---|---|
| Arsen | Yes | Yes | Replica interface | Done-for-you | With phishing and vishing, audit-ready |
| Callstrike | Yes | Yes | Joins live calls | Self-serve or managed | Heatmaps, compliance |
| Adaptive Security | Yes | Yes | Not stated | Not stated | Person and team risk score |
| Hoxhunt | Yes | Yes | Look-alike meeting | Vendor-built, admin-launched | Fail rate over time |
| Frame Security | Yes | Yes | Not stated | Not stated | Human Risk Score |
| KnowBe4 | Yes | Yes | Training video | Admin-built module | Completion, engagement |
| Keepnet | Yes | Yes | Zoom/Teams-style meeting | Not stated | Pass/fail, personas |
Which deepfake simulation platform fits your team?
The right choice depends on who will build the scenarios and where your executives actually meet.
- Choose a self-serve tool such as Callstrike if a red team or security engineer will script and run each deepfake.
- Choose a vendor-built or done-for-you model such as Hoxhunt or Arsen if your team should not build an executive likeness itself.
- Choose a training module such as KnowBe4's if the goal is awareness content featuring your own leader.
- Choose a multi-channel chain such as Keepnet or Arsen if you want to test the email that leads to the call, not only the call.
What should you ask a deepfake simulation vendor?
- Does the simulation join live calls or reproduce the meeting interface, and for which platforms?
- Is the deepfake live and two-way, or a generated video?
- Who builds the executive likeness, and how is the executive's consent documented?
- Do deepfake results appear next to phishing and vishing results?
- What happens to the employee right after a failure?
-
Compare the meeting experience (live call, look-alike interface or training video), who builds the scenarios, the channels covered and what happens right after an employee fails. Then check that deepfake results sit in the same report as your phishing and vishing simulations.
-
It is software or a service that runs authorized attacks using an AI-generated likeness of a trusted person, often an executive, to test whether employees verify a request before acting. Results show who complied, who reported, and where coaching is needed.
-
Callstrike states that it joins live Microsoft Teams, Google Meet and Zoom calls. Hoxhunt and Arsen reproduce the Teams, Meet or Zoom interface in a look-alike meeting, and Keepnet describes a simulated Zoom or Teams-style meeting.
-
With self-serve, your team builds the persona and scenario in the vendor's tool. With done-for-you, the vendor builds the executive deepfake, the scenario and the schedule, and your team approves it. The second model trades some control for less internal effort.
-
No. Detection scores whether a face or voice is synthetic on the channels it covers. A simulation tests whether a person verifies through a second channel before paying or granting access, which is the step that failed in documented losses such as Arup.
