Keepnet, an Extended Human Risk Management (xHRM) platform, today announced that its voice and SMS phishing simulation data contributed to the 2026 Verizon Data Breach Investigations Report (DBIR). The 2026 edition is the first to include voice and SMS phishing simulation data at this scale. The DBIR records this as “an increase of 40% in the median click rate” between phone-centric and email-based simulations (Verizon 2026 DBIR, p. 50).
According to the report, phone-centric phishing simulations show a median click rate of 2%, compared to 1.4% for email simulations (Verizon 2026 DBIR, p. 50). On the same page, the DBIR team writes that they “struggled to find companies doing simulations of voice- and text message-based campaigns”. That gap between attacker behaviour and industry measurement is widening, and it’s the story underneath this year’s report.
Keepnet’s name appears in the contributing organisations list on page 118.
Phishing has expanded beyond email. Attackers now combine voice, SMS, and email in coordinated campaigns that email-only awareness programmes weren’t built to detect. A few things shifted since 2022.
Attackers stopped relying on email-only inboxes. They now lead with voice and SMS, often in the same campaign. Email phishing is asynchronous. A target can pause, reread, ask a colleague. Voice and SMS attacks are synchronous. The target has seconds, not minutes. Attackers have already shifted channels. Most awareness programmes haven’t.
The cost of getting this wrong is no longer theoretical. The 2024 Hong Kong deepfake call cost a multinational $25 million. The FBI’s 2025 IC3 report puts smishing and vishing losses from government impersonation alone at $798 million in 2025, and adds a new AI-related cybercrime category at $893 million in the same year (source: FBI IC3 2025 Annual Report). The 2026 DBIR reports a median ransom paid of $139,875, with the economics of breaches continuing to favour attackers (Verizon 2026 DBIR, p. 11). For most security teams, the gap between what’s measured and what’s being exploited is now where the real money is being lost.
Gartner forecasts that by 2027, AI agents will reduce the time it takes to exploit account exposures by 50%, with explicit attention to “social engineering based on deepfake voices” and “end-to-end automation of user credential abuses” (source: Gartner, March 2025 press release). In practice, much of this can already be automated. One system gathers background information before the call, another runs the conversation itself, and follow-up SMS or email can be triggered seconds later, with no human operator in the loop except to collect the credentials at the end.
As automation cuts attacker cost toward zero and pushes volume up, the economics of who gets targeted change. Today, mostly enterprises with high-value help desks face this risk consistently. In 24 months, almost every organisation will. The economics changed fast. AI lowered the cost of running these attacks at scale while making them much harder to detect.
Keepnet has been running voice and SMS phishing simulations since 2022. Customers include global banks, Fortune 500 companies, and smaller mid-market organisations. Phone number coverage runs across the US, UK, EU and parts of Asia. Keepnet operates in line with ISO/IEC 42001:2023 and EU AI Act requirements. Beyond the automated simulations, Keepnet also runs live voice-based social engineering assessments against help desks and high-risk employee groups, with a real social engineering team on the call.
Historically, phishing benchmarking has focused primarily on email-based simulations, while voice and SMS scenarios remained under-measured. Keepnet’s contribution to the 2026 DBIR captures the channels attackers are now using to bypass email-only defences, with anonymised, campaign-level data from customer simulations between October 2024 and October 2025.
Across the simulations Keepnet runs at scale, the same playbook keeps working for attackers. Usually the email lands first to set context. Then comes the SMS. The phone call is often the final push. In many cases the help desk senses something is off, but the attacker keeps the call moving fast enough that verification never starts. That’s the gap security and risk leaders should plan around in their 2026 awareness budgets.
“We’ve spent years measuring email click rates because email data was easy to collect. The phone channel is harder to measure, but the DBIR data shows the risk is higher there. Most awareness programmes are still grading on email alone. The next step for security leaders is building verification habits into the phone channel too,” said Ozan Ucar, Founder & CEO of Keepnet.
Keepnet invites CISOs, security and risk leaders, and SOC managers to request a personalised voice and SMS phishing assessment to:
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。