Train your employees against the next wave of phishing: deepfakes

How do you train employees against deepfake phishing? You put them inside a realistic deepfake scenario before a real attacker does. Hoxhunt deepfake phishing training simulates a video call with a cloned executive who asks the employee to act, then turns any mistake into a safe learning moment. It builds the instinct to question requests that look and sound genuine.

AI is changing the threat landscape

Deepfake technology has already enabled multimillion-dollar scams. In a widely reported 2024 case at engineering firm Arup, fraudsters used a deepfake CFO in a video call to trick an employee into paying out 25 million dollars (CNN, February 2024). These attacks are no longer science fiction — they’re real, and they’re costly.

Phishing is evolving beyond text and email. Now, attackers can replicate faces, voices, and mannerisms, making it nearly impossible to trust what you see and hear. Organizations must prepare their people for this reality.

Introducing Hoxhunt’s deepfake phishing attack simulation

We’re proud to launch our Deepfake Phishing Attack training — a first-of-its-kind simulation that takes employees inside a realistic deepfake scam scenario.

Here’s how it works:

• Employees receive a simulated phishing email, appearing to come from a trusted colleague or executive.
• The email invites them to join a video call (Teams, Google Meet, or Zoom).
• On the call, a deepfaked avatar — cloned from a real person from your organisation — asks them to click a link in chat.
• If they do, they land on a simulation failed page, turning the mistake into a learning moment.
• Alternatively, the deepfake experience can be delivered directly inside Hoxhunt Security Awareness Training — allowing employees to learn from the scenario in a safe training environment, even without engaging with a phishing attack first.

Why this training matters

The threat is no longer hypothetical. The Hoxhunt Phishing Trends Report 2026 found AI-generated phishing surged roughly 14 times in a single month, climbing from under 5% to 56% of detected attacks, and Hoxhunt research showed AI spear-phishing agents now beat elite human red teams at getting people to click. Defenders need to practice against this same generation of attacks.

Traditional phishing awareness only covers emails. But the threats of tomorrow are multi-step, multimedia, and powered by AI. By experiencing a deepfake first-hand, your employees learn:

• To question suspicious requests — even if they look and sound real.
• To recognize urgency, emotional manipulation, and unexpected tasks as red flags.
• To build resilience against the cutting edge of social engineering.

Fully customizable to your organization

Every deepfake training can be tailored to your context:

• Impersonate your executives — likeness and voice of your leadership team.
• Choose the environment — Teams, Google Meet, or Zoom.
• Pick the targets — all employees for broad awareness, or specific high-risk groups such as finance teams, executive assistants, or direct reports of the C-suite.
• Adapt the format — full video + audio or audio-only.

Realistic, varied simulation at scale is what builds this resilience. In the US, Copart delivered 963 unique simulation variants across 202,992 completed simulations, and in Europe engineering consultancy Ramboll completed more than 100,000 simulations across 17,000 employees in 35 countries.

Prepare today for the threats of tomorrow

To go deeper, see our guide to the best phishing simulation tools, read more on how deepfake attacks work, and learn why most phishing simulations fail to reflect real attacks.

AI-powered attacks will only get more convincing. Defenses built on yesterday’s threats won’t be enough. With Hoxhunt deepfake training, you can safeguard your people — and your business — from the next generation of social engineering.