Keepnet, an Extended Human Risk Management (xHRM) platform, today announced that its voice and SMS phishing simulation data contributed to the 2026 Verizon Data Breach Investigations Report (DBIR). The 2026 edition is the first to include voice and SMS phishing simulation data at this scale. The DBIR records this as “an increase of 40% in the median click rate” between phone-centric and email-based simulations (Verizon 2026 DBIR, p. 50).
According to the report, phone-centric phishing simulations show a median click rate of 2%, compared to 1.4% for email simulations (Verizon 2026 DBIR, p. 50). On the same page, the DBIR team writes that they “struggled to find companies doing simulations of voice- and text message-based campaigns”. That gap between attacker behaviour and industry measurement is widening, and it’s the story underneath this year’s report.
Keepnet’s name appears in the contributing organisations list on page 118.
Why phone-centric phishing has outpaced measurement
Phishing has expanded beyond email. Attackers now combine voice, SMS, and email in coordinated campaigns that email-only awareness programmes weren’t built to detect. A few things shifted since 2022.
- Voice cloning got cheap. Voice cloning removed most of the realism problem once it became easy to access. Real-time conversations now happen in dozens of languages, with cloned executive voices that are getting harder to distinguish from the real person.
- MGM moved voice phishing from personal to corporate. The MGM Resorts breach in September 2023, which started with a 10-minute phone call to the help desk, cost the company an estimated $100 million. It broke the long-held assumption that voice phishing was an individual problem rather than a corporate one.
- Pretexting went mainstream. The live manipulation of a person on a call or chat has gone from fringe tactic to mainstream attack pattern. AI now writes the scripts and voices the calls. It adapts mid-conversation. A lot of awareness training still focuses mainly on the email side, not this.
Attackers stopped relying on email-only inboxes. They now lead with voice and SMS, often in the same campaign. Email phishing is asynchronous. A target can pause, reread, ask a colleague. Voice and SMS attacks are synchronous. The target has seconds, not minutes. Attackers have already shifted channels. Most awareness programmes haven’t.
What the data points to
- The phone is the corporate attack surface most awareness programmes are still measuring the least
- Pretexting, real-time manipulation on a call or chat, requires different countermeasures from email anti-phishing
- Recent high-profile incidents show attackers are already exploiting this surface while most companies are still figuring out how to measure it
- The more important question is no longer who clicked. It’s how far the conversation progressed before verification happened
What this means for security teams
The cost of getting this wrong is no longer theoretical. The 2024 Hong Kong deepfake call cost a multinational $25 million. The FBI’s 2025 IC3 report puts smishing and vishing losses from government impersonation alone at $798 million in 2025, and adds a new AI-related cybercrime category at $893 million in the same year (source: FBI IC3 2025 Annual Report). The 2026 DBIR reports a median ransom paid of $139,875, with the economics of breaches continuing to favour attackers (Verizon 2026 DBIR, p. 11). For most security teams, the gap between what’s measured and what’s being exploited is now where the real money is being lost.
- Help desks are now part of the attack surface
- Verification procedures matter more than awareness alone
- Repetition under realistic conditions is what holds up under pressure, not annual training
- Email-only simulations leave major attack channels untested
What comes next: AI agents that run the whole attack
Gartner forecasts that by 2027, AI agents will reduce the time it takes to exploit account exposures by 50%, with explicit attention to “social engineering based on deepfake voices” and “end-to-end automation of user credential abuses” (source: Gartner, March 2025 press release). In practice, much of this can already be automated. One system gathers background information before the call, another runs the conversation itself, and follow-up SMS or email can be triggered seconds later, with no human operator in the loop except to collect the credentials at the end.
As automation cuts attacker cost toward zero and pushes volume up, the economics of who gets targeted change. Today, mostly enterprises with high-value help desks face this risk consistently. In 24 months, almost every organisation will. The economics changed fast. AI lowered the cost of running these attacks at scale while making them much harder to detect.
Why Keepnet
Keepnet has been running voice and SMS phishing simulations since 2022. Customers include global banks, Fortune 500 companies, and smaller mid-market organisations. Phone number coverage runs across the US, UK, EU and parts of Asia. Keepnet operates in line with ISO/IEC 42001:2023 and EU AI Act requirements. Beyond the automated simulations, Keepnet also runs live voice-based social engineering assessments against help desks and high-risk employee groups, with a real social engineering team on the call.
Historically, phishing benchmarking has focused primarily on email-based simulations, while voice and SMS scenarios remained under-measured. Keepnet’s contribution to the 2026 DBIR captures the channels attackers are now using to bypass email-only defences, with anonymised, campaign-level data from customer simulations between October 2024 and October 2025.
Across the simulations Keepnet runs at scale, the same playbook keeps working for attackers. Usually the email lands first to set context. Then comes the SMS. The phone call is often the final push. In many cases the help desk senses something is off, but the attacker keeps the call moving fast enough that verification never starts. That’s the gap security and risk leaders should plan around in their 2026 awareness budgets.
“We’ve spent years measuring email click rates because email data was easy to collect. The phone channel is harder to measure, but the DBIR data shows the risk is higher there. Most awareness programmes are still grading on email alone. The next step for security leaders is building verification habits into the phone channel too,” said Ozan Ucar, Founder & CEO of Keepnet.
How security teams can benchmark voice and SMS phishing exposure
Keepnet invites CISOs, security and risk leaders, and SOC managers to request a personalised voice and SMS phishing assessment to:
- Measure baseline click and conversation-continuation rates on phone-centric simulations
- Benchmark against the 2026 DBIR phone-centric click rate finding
- Test help desk and VIP employee resilience with the Keepnet social engineering team
- See how prepared employees are across voice and SMS phishing scenarios
