Use case · Voice and SMS
Test the teams attackers phone, not just the ones they email
Some of the most expensive attacks never involve an email: the "IT helpdesk" call asking someone to read out a code, the urgent call from "the CEO" about a payment, the text message about a parcel or a bank login. If your people answer phones and approve things, email simulation alone tests the wrong channel.
Voice, automated voice, and text
Vishing
Simulated calls that test whether staff verify identity before giving out information, resetting a password or approving a change.
Automated voice (IVR)
Scripted voice-response calls that ask the person to press keys or enter codes — the pattern behind fake bank-security and MFA-reset calls.
Smishing
Text messages with links to simulated pages: delivery notices, bank alerts, "your account will be locked".
Each one records what the person did, feeds the same awareness score as the email simulations, and can be followed by targeted training.
Six teams, and the habit each test is really measuring
Service desk and IT support
A caller impersonating an employee to reset a password or MFA. The habit: identity verification before any reset.
Finance and accounts payable
A "CEO" or "supplier" calling to change bank details or rush a payment. The habit: call back on a known number, and dual approval.
Call centers and customer service
A caller extracting customer data. The habit: holding the data-disclosure rules under pressure.
Reception and front desk
A caller or visitor gathering names, schedules and access details. The habit: knowing what can be shared, and with whom.
Field and mobile staff
SMS lures that arrive on phones rather than in inboxes. The habit: handling a link on a small screen.
Executives and assistants
Personalized calls and texts. The habit: verification, for the people worth the most effort to target.
Set up and run by our team, every time
Call scripts, sender identities and timing have to be agreed before anything goes out, which is why these campaigns are not self-service.
- 01
Agree the scope
Teams, scenarios, call scripts, sender identities and timing, signed off with you and, where needed, with your works council.
- 02
Run it
Calls and messages go out within the agreed window.
- 03
Follow up
Anyone who disclosed information or followed the prompt receives short, specific training. Nobody is singled out publicly.
- 04
Report
Results by team and by scenario, alongside your email simulation results.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Generally yes, as part of an authorized security program — but the details are where this goes wrong, and they are worth settling in writing. Whether calls are recorded, what employees were told in advance, and what your works-council agreements say all matter.
We agree all of it with you before anything runs, and we do not record calls unless you have decided to record them and have told your staff. Your own counsel should confirm the position for your jurisdiction; we will not be the ones telling you it is fine.
Only with that person’s explicit approval, and usually without using a real voice.
In practice a pretext — someone calling on behalf of the CEO’s office — tests the same habit, which is whether the person verifies before acting. The habit is what you are measuring, and it does not require the impersonation to be convincing enough to be uncomfortable afterwards.
No. Voice and SMS simulations are scoped and priced per engagement, because the scripts, the numbers and the call volumes vary too much to sit inside a per-employee fee. They can be added to either the Platform or the Managed option.
Where to go next
Phishing Investigation
A report button, our analysts, and removal from every mailbox that got it.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.