There is a particular moment in every security awareness training session that decides whether the training works or not. It is not the moment the employee learns what phishing is. It is not the moment they see the simulated attack. It is the moment, weeks later, when a real threat lands in their inbox or on their phone, and their brain has to decide in three seconds whether to trust it.
Everything before that moment is just preparation for it. And the question every training platform should be asking is: what did we put into that person’s memory that will fire when the threat arrives?
For two decades, the answer has been text. Slide decks, e-learning modules, animated videos with English voiceovers and translated subtitles. The industry has built an enormous content library on the premise that if you show an employee enough information about threats, they will recognise threats when they see them.
This is not how memory works. This is not how decision-making under pressure works. And this is not how the most effective training in any other field, aviation, military, medicine, has ever been designed.
The training that changes behaviour is the training that arrives in the form your brain expects the threat to arrive in. A pilot does not learn to handle engine failure by reading about engine failure. They sit in a simulator that sounds like the cockpit, with instruments that respond like the instruments, and a calm instructor voice that resembles the captain they will one day become. The fidelity of the simulation matters because the brain encodes it as something close to a real memory, retrievable in real conditions.
Security training has not had this fidelity. It has had information.
The voice problem.
The threat surface has reversed.
Mandiant’s M-Trends 2026 report draws on more than 500,000 hours of incident-response work. Voice phishing accounted for 11% of the initial infections Mandiant observed in 2025, compared with 6% for email phishing. CrowdStrike separately reported a 442% increase in vishing activity between the first and second halves of 2024. Voice now deserves the same training attention as the inbox.
We wrote about this in detail in The phone call is the new phishing email. The pattern is consistent. An attacker calls an employee or IT help desk, sounds familiar, references internal systems, and asks the person to approve access or share a credential. No malicious attachment is required. The pretext does the work.
Now layer in voice cloning. McAfee researchers found that one tool produced an 85% voice match from a three-second sample, with more training data improving the result. The lesson is not that every clone is perfect. It is that familiarity alone is no longer a reliable verification method.
The CFO who receives a call from someone who sounds exactly like the CEO, asking for an urgent wire transfer, is making a decision in three seconds based on whether the voice feels right. The training that prepares this CFO using English text on a screen is preparing the wrong faculty for the wrong moment. The CFO’s brain, when the call arrives, is not searching for information. It is searching for a pattern. Something it has heard before, in a voice it has heard before, in a context it has heard before.
This is the gap voice closes. Not voice as a feature. Voice as a memory format.
The multilingual problem on top of the voice problem.
Most enterprise workforces are not monolingual, and most enterprise security training pretends they are. The standard approach has been to build content in English, ship it globally, and treat every other language as a translation layer applied at the end. The voice, where there is one, is recorded in a studio in one accent, translated into subtitles for everyone else, and delivered as a single global module.
This collapses on contact with how people actually think and how attackers actually attack.
A native French-speaking employee in Montreal does not train their threat-recognition faculty in English with French subtitles. A Bahasa-speaking employee in Jakarta does not encode threat patterns from a video voiced by a North American narrator. A native Arabic-speaking employee in Riyadh, Cairo, or Dubai is not preparing for a phishing call in fluent Gulf-accented Arabic by listening to a translated approximation of someone else’s language.
When the real call arrives in the employee’s actual language, with the cultural references and idioms and authority cues their brain is tuned for, the prepared pattern does not fire. There is no prepared pattern. The training was built in a different language than the threat.
Attackers can adapt language, cadence, and authority cues to the person they are targeting. A generic English-language awareness module does not prepare someone for a live call shaped around their own working context. The fidelity gap is the attack surface.
This is not a localisation problem to be solved with better translation. It is a foundational problem with how security training is generated. The session has to be built in the language from the start, not translated into it at the end. The voice has to sound like a voice from the employee’s actual context, not a generic narrator with subtitles. The cultural references in the scenario have to be the cultural references the employee actually lives inside.
What changes when voice and language are built in.
Excera builds safe human-risk simulations around role, authority, language, and context. Voice is not narration added to a lesson. It is one of the channels the person may have to judge under pressure.
A new joiner at a Riyadh bank should not face the same pretext as a CFO at a Dubai logistics firm. The target decision, authority cue, language, and voice register all change. That difference is what makes the simulation useful.
Excera has been selected for the ElevenLabs Startups programme. That support gives us practical room to test multilingual voice delivery while we work with design partners on the decisions the experience needs to rehearse.
The value is operational, not ornamental. Voice generation is useful only when the scenario, language, role, and authority cue are specific enough to make the decision believable.
We are grateful for the support. It helps us build the voice layer with more care and test it in the contexts where it matters.
What we are building toward.
The thesis behind Excera is that awareness is not the same as readiness. People need to recognise the pretext, authority cue, and channel pressure before a real attacker uses them. That is why the experience has to feel close to the decision, not merely explain it.
Voice is one layer of that. Multilinguality is another. Both have been broken in this industry for the longest, and both are where the difference between a checkbox and a defence is most acute.
We will be writing more about the rest of the system: cultural context, role-aware pretexts, generation versus selection, and how to measure human decisions without turning the experience into another compliance module. Voice and language are important layers. The thesis is bigger than either.
If you are responsible for security awareness or human risk in your organisation and the existing options have not worked, we would like to hear from you. Excera is opening design-partner conversations around English and Arabic experiences.