Three types of deepfake training
Vendors use "deepfake simulation" for very different things. This article separates three types.
- Live, interactive simulations: an AI-generated voice or video persona responds to the employee during the exercise, for example a cloned executive who answers questions on a phone call.
- Simulated deepfake video meetings: the employee joins a realistic meeting, often in a familiar conferencing interface, with an impersonated executive. The scene can be convincing without supporting open conversation.
- Pre-recorded deepfake training content: employees watch a deepfake video, for example of their own CEO, inside a training module. This teaches awareness but does not test how people react under pressure.
Voice cloning does not automatically mean live conversation, and vishing training does not automatically mean AI-powered calls. Where a vendor does not say which type it offers, its section below notes what to confirm.
How the top 8 platforms were compared
Each vendor was checked against its own product pages, press releases and trust documentation in October 2026. No independent hands-on tests were run, and no numerical scores were assigned. Five criteria shaped the recommendations.
- Live deepfake simulation. Real attacks are conversations. A platform that lets employees practise against a responding voice or video persona tests behaviour, while a video they watch only raises awareness.
- Attack currency. Attackers change pretexts quickly. Platforms that turn current campaigns into simulations keep training relevant.
- OSINT personalisation. A deepfake works when the surrounding story fits, such as the right supplier, project or manager. Buyers also need to know how much personal data that requires.
- Data location and GDPR considerations. Hosting region, subprocessors and transfer mechanisms affect procurement, data protection impact assessments and works council discussions in Europe.
- Programme fit. Deepfake exercises need training, reporting and integration around them to change behaviour over time.
Buyers who weigh these criteria differently will reach different conclusions. A company that needs a one-off red-team test of its payment process, or that already runs KnowBe4 or Proofpoint, may be better served by another vendor. Where public evidence is thin, the article says so instead of ranking on assumptions.
Buyer summary
revel8 suits European enterprises that want coordinated deepfake-led simulations across email, SMS, voice and video, built from current attacks, personalised with consent-based OSINT and hosted in Germany. Breacher.ai fits organisations that need to test payment and help-desk procedures against interactive deepfake attack chains. Brightside AI focuses on AI vishing and employee data exposure. Adaptive Security suits global buyers wanting awareness and email security from one vendor. Hoxhunt and SoSafe suit engagement-led programmes with browser-based voice training. KnowBe4 and Proofpoint ZenGuide suit their existing customers.
Top 8 deepfake awareness training platforms compared
| Platform | Headquarters | Best use case | Standout feature |
|---|---|---|---|
| revel8 | Munich, Germany | European enterprises wanting realistic deepfake training based on current attacks, hosted in Germany | Coordinated deepfake-led simulations across email, SMS, voice and video, built from live threat intelligence and OSINT |
| Adaptive Security | New York, USA | Global organisations wanting awareness training and email security from one vendor | Conversational AI agents that simulate attacks across email, voice, SMS and video |
| Hoxhunt | Helsinki, Finland | Large, distributed workforces focused on engagement | Gamified adaptive training with AI voice agents and simulated deepfake meetings |
| Brightside AI | Switzerland | Mid-sized organisations focused on vishing and employee data exposure | AI vishing that adapts to responses, combined with digital footprint reduction |
| Breacher.ai | Orlando, USA | Testing payment and help-desk procedures against full deepfake attack chains | Live deepfake avatars on Teams, Zoom and Meet, with re-testing and risk scoring |
| KnowBe4 | Florida, USA | Existing KnowBe4 customers adding deepfake content | Personalised deepfake training videos featuring the organisation's own leaders |
| SoSafe | Cologne, Germany | DACH programmes built on behavioural-science e-learning | Psychology-based training with phishing, smishing and interactive vishing lessons |
| Proofpoint ZenGuide | California, USA | Organisations already using Proofpoint email security | ThreatFlip, which turns real phishing emails into simulation templates |
1. revel8
What it offers. revel8 is a Munich-based security awareness and human risk management platform. Its simulations are built from attacks circulating right now and cover email, SMS, WhatsApp, Telegram, voice and deepfake video. AI personas place live calls and leave voicemails, deepfake clones of executives join live meetings, and a single scenario can escalate from an email to a call or meeting. Training covers interactive modules, adaptive learning paths, a compliance catalogue for GDPR, NIS2, DORA and ISO 27001, and SCORM export to existing learning systems. A contact centre module runs voice attacks against front-line staff and AI agents.
Key differentiator. Simulations that follow the latest attack campaigns, delivered as live video deepfakes and voice phishing, coordinated across channels and personalised with threat intelligence and OSINT.
What to verify. Ask which recent campaigns the newest scenarios were built from, and run a deepfake call and meeting in a demo to see how the personas respond. Confirm subprocessors and where AI processing takes place.
Best for: European enterprises that want realistic voice and video deepfake exercises built from current attacks, with data hosted in Germany.
2. Adaptive Security
What it offers. Adaptive Security, based in New York, uses conversational AI agents to run simulations across email, voice, SMS and video. Its scenarios draw on job listings, executive interviews, press releases, regulatory filings and employees' social media. The portfolio also includes email security and AI governance.
Key differentiator. Broad AI-driven simulation coverage combined with email security in one vendor, and more than 100 integrations according to the vendor.
What to verify. Adaptive's compliance page states that its Trust Center identifies AWS hosting in the United States, region us-east-2, and offers a GDPR policy and Data Processing Addendum on request. US hosting does not make a service non-compliant with GDPR. It does mean EU customers need to review the transfer mechanism, the subprocessor list and the safeguards in place. Because scenarios can use employees' social media, check the legal basis, and assess it in a DPIA where one is required.
Best for: US-based or global organisations that want awareness training, email security and AI governance from one vendor and accept US hosting.
3. Hoxhunt
What it offers. Hoxhunt, based in Helsinki, is known for gamified, adaptive phishing training. Its Voice Phishing Training lets employees talk to AI voice agents that respond to the flow of the conversation inside the training experience. Its phishing training also covers callback simulations with voice cloning, SMS, Microsoft Teams and deepfake attacks. The deepfake module recreates an executive's likeness and voice in the meeting platform employees use and records who engaged, how long they hesitated and which cues they missed.
Key differentiator. Interactive AI voice training and deepfake meetings integrated into an established, engagement-focused programme with group-level fail rates.
What to verify. Hoxhunt's AI voice agents are documented as browser-based training. Callback simulations are scenarios where the employee calls a number from a lure. Confirm whether Hoxhunt also places outbound live AI calls, whether the deepfake executive holds an open conversation, and where data is hosted.
Best for: large, distributed workforces that want high engagement and treat deepfakes as one part of a broad phishing programme.
4. Brightside AI
What it offers. Brightside AI is a Swiss provider focused on AI-powered social engineering. Its vishing simulation uses AI voice conversations that adapt to employee responses. The vendor's product listing adds multilingual voices with custom voice cloning and hybrid campaigns that combine a call with a supporting email. Brightside also analyses employees' public digital footprint to personalise simulations and helps reduce that exposure.
Key differentiator. Live AI vishing combined with OSINT exposure management.
What to verify. Brightside describes deepfake voice and video simulation capabilities. Confirm the video format, German-language scenarios, hosting location and how employee footprint data is processed.
Best for: mid-sized European organisations that want AI vishing and personal data exposure reduction, often alongside an existing awareness platform.
5. Breacher.ai
What it offers. Breacher.ai, based in Orlando, runs orchestrated deepfake simulations that chain email, SMS, voice calls and video. A live avatar joins Teams, Zoom or Google Meet and holds the conversation, and an AI voice agent places calls, leaves voicemails and answers callbacks. The platform then generates training from what failed, re-tests the same scenario and reports a risk score against sector peers. It can run self-service, fully managed or white-labelled for partners.
Key differentiator. Extensively documented interactive deepfake attack chains that follow the attack past the click into callbacks, help-desk resets and payment approvals. Executive voices are cloned only with the consent of the person concerned.
What to verify. Confirm hosting region, data residency for EU employees and how well the training curriculum covers topics beyond social engineering.
Best for: organisations that need to prove whether payment, callback and help-desk procedures hold against a full deepfake attack, then train and re-test.
6. KnowBe4
What it offers. KnowBe4 offers one of the largest security awareness content libraries and is widely used in large enterprises. Its Deepfake Training Content Agent generates a deepfake video of a leader from the customer's own organisation from a short video and audio sample, using prebuilt or custom scenarios. Its vishing campaigns call employees' phones and play a pre-recorded or text-to-speech message that asks for a PIN or similar number, and the result feeds KnowBe4's risk reporting.
Key differentiator. Personalised deepfake videos and vishing tests deployed inside existing training campaigns at very large scale.
What to verify. The deepfake feature is a training video that employees watch, not a live meeting that tests their reaction. KnowBe4's July 2026 announcement describes realistic conversations, while the product guide describes recorded or synthesised messages answered by keypad. Confirm whether live conversational AI calls are available or planned. KnowBe4 runs EU and German platform instances, so confirm which one your data uses.
Best for: organisations already using KnowBe4 that want deepfake demonstration content and vishing tests inside their current programme.
7. SoSafe
What it offers. SoSafe, based in Cologne, is one of Europe's largest security awareness providers and builds its training on behavioural psychology. Its Simulation Studio manages phishing, smishing and vishing tracks in one dashboard, with adaptive difficulty and microlearning after a risky interaction. Vishing training includes browser-based interactive lessons in which employees respond to a simulated IT-support call. A Recreate Attack feature turns real phishing emails into simulations.
Key differentiator. A mature, psychology-based programme from a European vendor, with e-learning in many languages and ISO 27001 and TISAX certification.
What to verify. The interactive vishing lessons run in the browser and are not outbound AI voice attack campaigns, which SoSafe's product pages do not document. Deepfake video simulations are not publicly documented either. Ask for a demonstration and compare it with the points in the revel8 vs. SoSafe review.
Best for: DACH organisations that want an established email, SMS and voice training programme with broad e-learning content.
8. Proofpoint ZenGuide
What it offers. Proofpoint ZenGuide is Proofpoint's security awareness training product. It runs phishing simulations from threat-informed templates, and its ThreatFlip feature turns real phishing emails into safe simulation templates. Training follows role- and risk-based pathways. Connected to Proofpoint's email security platform, ZenGuide uses its telemetry to focus training on the people attackers target most.
Key differentiator. Tight integration with Proofpoint's email security and human risk data, which is valuable for organisations already invested in that ecosystem.
What to verify. Live AI voice calls and interactive deepfake video meetings are not publicly documented for ZenGuide. Proofpoint's threat detection capabilities are separate from awareness simulation. Ask which voice and deepfake scenarios are available today.
Best for: organisations that already use Proofpoint for email security and want awareness training in the same stack.
What is the best deepfake awareness training platform for European companies?
The best deepfake awareness training platform for European companies is revel8. It brings together what European buyers need most in one platform. Five things set it apart.
Simulations built from current attacks. revel8 sources live threats from several intelligence feeds, customer security teams and community-shared scenarios, ranks them by the risk each user group faces and turns them into ready-to-run simulations. According to revel8, new attack methods can be replicated within hours. Employees therefore practise against the BEC scams, fake IT-support calls and meeting invitations circulating at the time.
Coordinated deepfake-led simulations across multiple channels. The Arup case started with an email and was confirmed on a video call. revel8 rebuilds this pattern. An invoice email can be followed by an SMS, an AI-persona call or a meeting invitation in which a deepfake clone of an executive appears, so employees experience how the channels reinforce each other.
Context from OSINT. Scenarios draw on organisational OSINT, such as vendor relationships, exposed infrastructure and tools named in job postings. Personal OSINT is used only for the highest-risk people and only with their consent.
Adaptive attack playlists. Each employee receives a personal sequence of scenarios based on role, behaviour and performance, with difficulty adjusted to avoid fatigue and a short lesson at the moment of interaction.
German hosting. revel8 runs on the STACKIT sovereign cloud in Germany and is ISO/IEC 27001:2022 certified. This simplifies the data residency review for many European buyers. It does not on its own establish GDPR compliance, and subprocessors, AI processing locations and support access still belong in the procurement review.
You can see these simulations with your own scenarios in a revel8 demo, create a deepfake of yourself with the free deepfake tool or read customer stories from organisations such as Zufall Logistics Group.
What to compare before choosing a vendor
A four- to eight-week pilot with finance, executive assistants and the IT help desk shows more than any feature list. The pilot scope template covers groups and KPIs in detail.
- Interactivity: Run one voice call and one video meeting. Check whether the persona answers questions in real time or follows a fixed script.
- Attack currency: Ask which real campaigns the three most recent new scenarios were based on, and when those campaigns appeared.
- OSINT scope: Request the data categories used per employee group and how consent and the DPIA are handled.
- Data location: Check hosting region, subprocessors, AI processing location and the transfer mechanism in the Data Processing Agreement.
- Training and reporting: Confirm immediate feedback for employees, group-level reporting for management and the works council, and export to your learning system.
