One call showshow your organisation really acts.
Unannounced phone attacks show how your employees act under real attack pressure: whether credentials are entered, how the conversation goes and how quickly — and every call ends as personal training.
Why vishing is the most underestimated social engineering risk
Classic awareness programmes barely address vishing. Our simulation closes exactly this gap.
Every vishing call combines assessment and training.
Every call has a goal. We measure what happens on the way there.
The goal of every simulation call is data entry: to get the person called to enter credentials on a page whose address the caller dictates during the conversation. Whether that succeeds is the first metric. What happens on the way there produces the rest — anonymised and against fixed criteria. Every call conducted ends in exactly one of three outcomes.
Outcome per call
The credentials are entered on the dictated page. The attack goal is reached.
No credentials are entered, but the caller gains critical information — such as names, systems, processes or access routes.
No entry, nothing disclosed. The person verifies, refuses or ends the conversation.
Campaign metrics
01Compromise rateShare of calls ending in success — across all calls and per month
The lead metric. In our campaigns it starts at around 67% and falls to around 12% over twelve months. In the HRC Cockpit it is called “attacker success rate”. Partial success and repelled are shown alongside — they show how close an attack came to data entry. The 88% at the top of this page is the counterpart: all calls without data entry — repelled attacks and partial successes together.
02Behaviour in the conversationHow the person meets the caller — seven defined behaviours from friendly to confrontational
After every call the trainer records which behaviour shaped the conversation: friendly, receptive, neutral, sceptical, confiding, worried, confrontational; several entries are possible. Aggregated, it shows whether friendliness eases the way in and where scepticism already takes hold — over the course of the campaign it becomes visible whether that pattern shifts.
03Time to data entryMedian minutes from the call to the entry — recorded for calls with data entry
The longer it takes, the more questions, hesitation and checking are in the conversation. If the time grows over the course of the campaign, the attack costs more effort — even where it still succeeds in the end.
04Location and departmentCompromise rate per location and per department
Reception, support, administration — and per location: the evaluation shows where attacks succeed most often and where training should start next — at group level, never at individual level.
05Change from call to callHow outcome, behaviour and time change between the first and later calls
Where a person is called again during the campaign, the later call is compared with their first — without names in the evaluation. This shows whether the training has landed — not just whether the average has moved.
06Participation rateShare of people called who go through the training right afterwards
Because the training takes place in the same call, the rate in our campaigns is around 98%. No appointment, no invitation, no chasing.
07Training ratingParticipants rate the training on a scale of 1 to 6, 1 = very good
Right after the training, anonymously. The rating shows whether the conversation was experienced as help or as exposure — for us the earliest warning sign of whether the campaign is accepted.
08Survey during the trainingFixed questions the trainer asks during the training
For example: is the reporting channel known? Has there been a suspicious call before? Is phishing a familiar term? Does the person feel confident about cyber security? The answers flow anonymised into the situational picture and add what employees know, and how confident they feel, to the behaviour observed.
Together these metrics show how your organisation acts under attack pressure: where scepticism takes hold, where accommodation opens doors, how quickly a conversation turns into access. What is assessed is the behaviour in the call, never the person.
The process: from attack to situational picture in a single call
The decisive difference: your employees do not know they are being measured. No announcement, no preparation — which is why we measure actual behaviour, not what employees state in questionnaires.
- Step 01 Attack Unannounced simulation, individual scenario
- Step 02 Measurement Outcome, behaviour, time to data entry — anonymised
- Step 03 Debrief & training Reflection and response strategies in the same call
- Step 04 Evaluation Aggregated situational picture and trend
In detail: from attack to situational picture
Realistic attack simulation
Our social engineering specialists carry out unannounced vishing attacks with individual scenarios tailored to your organisation and your industry.
- Industry-specific pretexts and scenarios
- Use of current attack techniques
- Goal of every call: entering credentials on a page dictated over the phone
- No difference between simulation and the real thing
Measurement: outcome, behaviour, time
Your employees react spontaneously, without knowing it is an assessment. We record whether the attack goal is reached, how the person behaves in the conversation and how much time passes from the call to data entry — anonymised, against fixed criteria.
- Real behaviour under attack pressure instead of questionnaires
- Success, partial success or repelled — per call
- Comparable across the campaign, locations and departments
- No named evaluation of individuals
The difference: immediate live training
After the call the vishing expert reveals themselves as a trainer. The training that follows builds directly on the emotions just experienced: intense, personal and effective. No questionnaire, no maturity model and no e-learning can do that.
- Tailored to the individual participant
- Emotional immediacy as a learning amplifier
- More lasting than any classroom training
- Concrete security knowledge conveyed directly
Aggregated management evaluation
The behavioural data recorded in the individual calls is evaluated across all attack simulations. The management reporting shows how your organisation behaves towards vishing, where strengths and areas for action lie and how the metrics develop over the course of the campaign.
- Evaluation at organisational level, without names
- Strengths and areas for action per location and department
- Trend across the campaign's duration
- Suitable for board, audit and security strategy
From the single call to the organisation's situational picture
Every call delivers an anonymised data record. Only the sum shows how the organisation acts — and the trend shows whether that changes. After a completed campaign around 88% of calls end without data entry — most of them repelled, the rest partial successes.
Single measurement
Outcome, behaviour in the conversation and time to data entry per call. The evaluation carries no names and no personal identifiers.
Campaign picture
Aggregated across all calls: compromise rate, behaviour in the conversation, strengths and areas for action by location and department, training rating and participation rate.
Trend
Month by month: the compromise rate falls, repelled attacks increase, the time to data entry grows. On this basis the effect of the training can be demonstrated.
What it looks like in the HRC Cockpit
The overview shows your Human Risk Management as a whole. The insights screen shows the vishing campaign: trend and outcome of the attacks, behaviour in the conversation, time to data entry, locations and departments, training rating and participation. The compromise rate is called “attacker success rate” there. Change from call to call and the survey answers are in the campaign report.
Mockup of the vishing insights view: attacker success rate from 67 to 12 percent over twelve months, partial success from 18 to 10 percent, attacks repelled from 15 to 78 percent; whole campaign 36 percent success, 14 percent partial success, 50 percent repelled; behaviour in the conversation, median 4:20 minutes to data entry, success rate by location and department, training rating 1.7 of 6 and participation rate 98 percent
Trend over the campaign — Show as table
| Month | Success | Partial success | Repelled |
|---|---|---|---|
| 1 | 67 % | 18 % | 15 % |
| 2 | 61 % | 18 % | 21 % |
| 3 | 55 % | 17 % | 28 % |
| 4 | 49 % | 16 % | 35 % |
| 5 | 43 % | 15 % | 42 % |
| 6 | 37 % | 14 % | 49 % |
| 7 | 31 % | 14 % | 55 % |
| 8 | 26 % | 13 % | 61 % |
| 9 | 21 % | 13 % | 66 % |
| 10 | 17 % | 12 % | 71 % |
| 11 | 14 % | 11 % | 75 % |
| 12 | 12 % | 10 % | 78 % |
- Success36 %
- Partial success14 %
- Repelled50 %
Attack outcome — Show as table
| Outcome | Share |
|---|---|
| Success | 36 % |
| Partial success | 14 % |
| Repelled | 50 % |
Behaviour in the conversation — Show as table
| Behaviour | Share of calls |
|---|---|
| Friendly | 64 % |
| Receptive | 41 % |
| Neutral | 33 % |
| Sceptical | 27 % |
| Confiding | 18 % |
| Worried | 12 % |
| Confrontational | 8 % |
Time to data entry — Show as table
| Duration | Share |
|---|---|
| under 2 min | 18 % |
| 2 to under 5 min | 44 % |
| 5 to under 10 min | 27 % |
| 10 min and over | 11 % |
Attacker success rate by area — Show as table
| Area | Success rate |
|---|---|
| Hamburg | 31 % |
| Berlin | 22 % |
| Munich | 16 % |
| Reception | 34 % |
| Support | 24 % |
| Administration | 13 % |
Demo mockup to illustrate the structure. All values are examples; the actual dashboard differs in layout and values.
Both screens are mockups with sample values. The actual dashboard differs in layout and values; your campaign's metrics come from your calls.
Want to go deeper?
Learn more about the threat of vishing, our training methodology and the psychology behind it — and see from a sample report how the results are prepared for management.
Brochure
Vishing Assessment & Awareness Training at a glance: threat, process, methodology, reporting.
LockedSample report
Full management report of a sample campaign with 25 calls (in German): attack outcome, location comparison, training rating, awareness questions, measures.
LockedPart 1 — The threat of vishing
Why a phone call gets past every technical layer of protection.
LockedPart 2 — The solution: our Vishing Awareness Training
How the caller reveals themselves as a trainer and what happens next.
LockedPart 3 — Deep dive: psychology & insights from the training
What psychological pressure attackers apply — and what we see in our training sessions.
LockedUnlock the content
Thank you!
Brochure, sample report and explainer videos are now unlocked — also on your next visit on this device.
Why questionnaires and knowledge tests do not produce a situational picture
Questionnaires and knowledge tests
- Maturity models and checklists
- Click rates from email phishing
- Knowledge checks after e-learning
- Self-perception instead of behaviour
- The phone remains a blind spot
HRC Vishing Assessment
- Measured behaviour under real attack pressure
- Outcome, behaviour and time — recorded per call
- 98% participation through unannounced simulation
- Measurable trend across the campaign
- Personal training in the same call
We deliberately kept the first assessment calls small (10). [...] The Human Risk team is now supporting us in the third year and the campaign has become indispensable.
We knew vishing was a relevant attack scenario. What we did not know: how our employees actually react. The assessment gave us exactly that transparency.
What I had not expected: that the employees were not annoyed afterwards but relieved. A colleague told me she was glad it was “only training” and not “real”. That is exactly the point. We have talked about security differently ever since.
Robust protection for your corporate security
Frequently asked questions
How realistic are the vishing simulations?
Our simulations cannot be distinguished from real attacks. We use industry-specific scenarios, current attack techniques and individually developed pretexts. Employees do not know that it is a simulation. On request we also integrate AI-supported attack methods and deepfakes into the scenarios to realistically reflect current and particularly demanding attack situations. We tailor the type and intensity of the simulations to the threat situation and the requirements of your organisation.
How objective is the measurement?
Every call has the same attack goal and is assessed against the same criteria: did the call end in success, in partial success, or was the attack repelled? How did the person behave in the conversation? How much time passed before data entry? What is assessed is what observably happens in the conversation — not how it felt or what the person states afterwards. This makes the results comparable across the whole campaign, across locations and departments.
What happens right after the simulation call?
Immediately after the call the vishing expert reveals themselves as a trainer. In a personal conversation the situation is resolved, the experience is put into context and concrete security knowledge is conveyed. This emotional immediacy is the key to lasting behavioural change.
Are individual employees exposed?
No. All results are anonymised and evaluated in compliance with the GDPR. It is about organisation-wide patterns and measurable improvement, reported strictly at organisational level, with no individual or named evaluation.
What distinguishes the assessment from the vishing pentest?
The vishing pentest tests whether an attacker reaches a specific goal over the phone — one result, one report. The assessment measures across many calls how the organisation as a whole acts, and trains every person called immediately afterwards. The pentest answers “Can it be done?”; the assessment answers “Where do we stand — and is it improving?”.
How many calls make sense?
The scope varies a great deal depending on objectives and risk assessment. For a first vishing assessment, 10 targeted attack simulations are often enough to gain a first insight into how employees actually behave. Many of our clients then opt for a long-term collaboration, involving on average around 10% of their employees in the simulations. Depending on risk assessment, company size and particularly exposed target groups, the scope can also be considerably larger — some of our clients started with a substantially higher number of simulations.
How long does a campaign run?
For a continuous campaign we recommend a duration of 50 weeks with at least one attack simulation per week. This creates regular learning impulses and measurement points throughout the year: employees are trained individually right after the simulation, and at the same time it becomes visible how behaviour develops over time. Shorter campaigns and individually tailored scopes are of course possible on request.
Ready to put your security to the test?
In a confidential, no-obligation first conversation, let's work out how to measure — and specifically train — your employees' behaviour towards vishing.