Features
Everything in the product, grouped by area. Every program includes all of it; the free demo includes the calls and the text simulations.
- 2
- languages for live calls: English and Spanish
- 3
- attempts to reach each person
- 3
- layers of background audio on a call
- 0
- credentials collected, ever
01 / 06
Vishing calls
An AI agent calls each person with a pretext and records what they do. The call is the exercise; the debrief is the lesson.
Opens by name
The agent greets the participant the moment the phone is picked up, with no silent pause.
Seven pretexts, or your own
Seven named pretexts, plus anything you can describe in a sentence.
Three difficulty levels
Low accepts the first refusal. Medium makes one follow-up. High arrives with a backstory and answers objections before they are raised.
Scored on three behaviors
Disclosure, verification and resistance, with the persuasion techniques used identified in the debrief.
A few at a time, with retries
A launch dials a few people and queues the rest. No answer, a busy line or voicemail earns a second and a third attempt. Anyone not reached is not charged.
What happened on the line
Each call's detail shows how long it rang, whether a person or a machine answered, who hung up, and the audio quality on both sides.
Test call before launch
Hear the agent on your own phone before anyone else does.
Background audio
Up to three layers of ambience mixed under the voice, each at its own level, from your files or the built-in library.
Voice cloning
Up to three cloned voices per workspace, with consent recorded as part of the flow.
Call recording, if you choose
Off by default. When enabled, the conversation is kept for a stated period and can be played or downloaded from the call's detail.
02 / 06
Text simulations
A phishing or smishing scenario in the browser, generated for your audience and scored on the decisions taken.
Generated, not picked from a library
Each scenario is produced from the brief you write: the audience, the risk, the context.
Two formats
A flowing conversation, or one decision at a time.
Generated imagery
Illustrative scenes, or a realistic copy of the interface being impersonated.
From a real phishing email
Paste the email you received, up to 20,000 characters. Sensitive details are removed before it is sent, and the result fills the form for you to edit.
No account needed
Participants take a training from an invitation link. Completion emails carry the score.
Five languages
Training content in five languages. Live calls in English and Spanish.
03 / 06
Running a program
The tooling around the exercises: who is enrolled, when, with which scenario, and how it is paid for.
Rosters remember people
Typing a name, number or department suggests the people this workspace has enrolled before.
Recurring campaigns
Enroll a rotating share of the roster each cycle, never the same person twice in a quarter. A person still initiates the dialing.
Adaptive targeting
Each person gets the scenario their own history suggests. It can be reviewed before dialing, and it says so when there is not enough history.
Bought in the app
Programs are yearly, paid by card and renewed automatically until stopped. Extra calls are bought the same way.
04 / 06
Measurement
One score, its components and the trend, computed from the figures rather than written by a model.
Resilience score
One number from 0 to 100, built from disclosure resistance, verification, repeat resistance and coverage, with the weights stated.
Unmeasured stays unmeasured
A component with no data is reported as such, never as zero and never as a perfect record. The score names its own blind spots.
Trend over time
Up to 24 periods, per training and per department.
Debrief for every call
What was attempted, how the person responded, which techniques were used and what to do differently, in the participant's language.
Reports in three formats
HTML to read, Markdown to paste into a ticket, JSON for other systems. Dashboards for owners, admins and trainers.
05 / 06
Safety and jurisdiction
An exercise has to be safe to run, for the people who are called and for the organization running it.
Never collects what it asks for
The agent stops before any information is exchanged. It measures willingness to disclose; it does not obtain anything.
Jurisdiction check before launch
Participants' numbers are resolved to their country, and the employment-law obligations known for it are shown: works-council agreements, consultations, impact assessments. Advisory, never a verdict.
Audio deleted after the call
Unless you choose to keep it.
Sensitive details removed
A pasted phishing email has its sensitive details removed before it reaches a model, and nothing the attacker wrote can trigger an action.
06 / 06
Platform
The workspace underneath: access, roles, integrations, and what is kept.
Isolated workspaces
Each organization has its own roles, data and analytics.
Four roles
Owner, admin, trainer and participant.
Sign-in
Google SSO, two-factor authentication with recovery codes, and a list of active sessions you can revoke.
Read-only API
Four scopes: trainings, participants, analytics, reports. Nothing external can start a training or place a call.
Outbound webhooks
Signed events for a disclosure, a completed call and a finished training, to your SIEM or wherever you need them.
Audit trail
Security and audit events kept 400 days by default, with retention enforced by the database.
A program, or the free demo
The demo is for trying both kinds of exercise on three people. Everything else is in every program, from Program 25 up.
| Feature | Every program | Free demo |
|---|---|---|
| People | 25 to 250 | 3 at a time |
| Vishing calls | 75 to 750 a year | Up to 3 |
| Text trainings | Up to 20 at once | 1 |
| Text formats | Conversation and one decision at a time | Conversation only |
| Voice cloning | Up to 3 voices | Not included |
| Background audio | Up to 3 layers | Not included |
| Generated images | Both styles | Not included |
| Recurring campaigns, adaptive targeting, API and webhooks | Included | Not included |
| Team | 5 admins and 10 trainers | The owner only |
This list reflects what runs today. Nothing still in design is on it.