The phone call is the new phishing email.

Mandiant’s M-Trends 2026 report draws on more than 500,000 hours of incident-response work. One shift stands out: voice phishing appeared more often than email phishing among the initial infection vectors Mandiant observed in 2025.

Email phishing accounted for 6% of observed initial infections. Voice phishing rose to 11%, making it the second most common vector after vulnerability exploitation. The phone call has become a serious front door, not a novelty.

This is not a marginal shift. This is a reversal.

The anatomy of a phone call you were not trained for.

The pattern is consistent. An attacker calls an employee or IT help desk, impersonates a trusted colleague, references familiar systems, and asks the person to approve access or share a credential. The request sounds operational. That is why it works.

One group, tracked as UNC6040, ran a campaign through the first half of 2025 targeting Salesforce environments. They called employees and guided them through authorising a modified version of a legitimate app. That access opened the door to Salesforce, Okta, and Microsoft 365. No malware. No exploit. A phone call and a convincing script.

Google’s threat-intelligence team has documented repeated success with this approach. In the activity it tracks as UNC6040, attackers manipulated users into authorising access. They did not exploit a Salesforce vulnerability. They persuaded a person to open the door.

Now add a cloned voice to the script.

AI voice cloning lowers the cost of making a familiar voice. McAfee researchers found that one tool produced an 85% voice match from a three-second sample. More training data improved the match further. A voice can feel familiar without being trustworthy.

CrowdStrike reported a 442% increase in vishing activity between the first and second halves of 2024. The FBI’s 2025 Internet Crime Report recorded more than 22,000 complaints containing AI-related information and nearly $893 million in associated losses. Its examples include voice cloning used to request wire payments.

11%

of observed initial infections involved voice phishingMandiant M-Trends 2026

442%

increase in vishing activity from H1 to H2 2024CrowdStrike 2025 GTR

85%

voice match produced from a three-second sample in one testMcAfee research

Your training covers the wrong channel.

Most security awareness programmes still centre on email. Spot the typo. Report the attachment. These are useful habits. They are beside the point when the attack arrives as a phone call in your line manager’s voice.

Help desk agents are trained to solve access problems quickly. A caller who knows the right system names can turn that helpfulness into pressure. The defence is not suspicion of every caller. It is a clear verification path that survives urgency and familiarity.

Firewalls filter. Email gateways quarantine. MFA challenges. And the attacker picks up the phone and walks around all of it by talking to a person. The gap between what your people encounter and what they have been prepared for is the attack surface now.

How Excera addresses this.

Excera simulates the channel and decision an attacker would target. A CFO can face an impersonation attempt built around payment authority. A help desk agent can face a caller trying to bend account-recovery controls. The context changes because the human attack surface changes with the job.

Each session selects the three most relevant threats, presents them conversationally, pauses to ask real questions, and adapts. Arabic or English, with AI voice narration in both. Ten minutes. Three specific behaviours to implement before Friday.

When the threat shifts from email to voice, the training has to shift with it. Not next quarter. Now.

The phone is ringing. The question is whether your people know what to do when they pick up.