You think your security is watertight.Until we call...
At DeepCalls, we test the extent to which employees share or change confidential information over the phone without proper verification. Every call is made by an experienced specialist.
In 60 to 80% of our assessments, we manage to take over an account or change data.
Organisations are configuring their systems ever more strictly with multi-factor authentication and strict protocols. Yet in practice, procedures on the phone can give way to a logical story. As long as verification depends on questions and the judgement of a single employee, a convincing caller with the right tone can get through.
In 60 to 80% of our assessments, we succeed in taking over accounts or getting critical information changed. Not because employees lack competence, but because a trustworthy voice makes the context so credible. Technical verification at the service desk can remove a large part of that risk.
Organisations often think carefully about their procedures. Only on the phone do you see whether they hold up.
Why would you want to test this?
A DeepCalls assessment makes these vulnerabilities immediately visible. It gives you the measurable results and hard data you need to:
Optimise processes: You see exactly where protocols and verification procedures are bypassed in practice.
Create targeted awareness: Employees experience first-hand how subtle deception is, which leads to lasting behavioural change.
Support technical decisions: You receive concrete advice on technical verification measures that help prevent misuse over the phone.
DeepCalls maps these risks. Controlled, authorised and without operational disruption.
Tailored. Impact. Results.
DeepCalls carries out voice phishing assessments the way attackers operate, with a credible story, the right timing and an experienced caller who knows how processes and people in organisations really work.
Every assessment is fully tailored. Scenarios are developed based on your sector, your internal processes and your risk profile, so the report shows not only what went wrong, but also why.
Voice Phishing
Realistic, authorised assessments that test how resilient your organisation is against social engineering by phone.
Every assessment begins with a thorough intake. DeepCalls maps your organisation, sector and internal processes and, on that basis, develops scenarios that match your actual risk profile. No standard scripts, but situations that are recognisable to your employees and credible in your context.
Account Takeover (ATO)
Specialised assessments for multinationals and complex enterprise environments to test the identification and verification processes at helpdesks.
Every engagement starts with a targeted analysis. DeepCalls maps the processes and, on that basis, simulates targeted ATO attempts. No aggressive pressure, but scenarios with the right tone and timing to examine whether accounts can actually be taken over.
Identity verification at the service desk
Technical verification replaces knowledge questions and the judgement of a single employee with a control that the caller must pass themselves.
Process analysis
An assessment shows what happens. A process analysis shows why.
AI Voice Phishing Simulations
For organisations that want to test at scale, in multiple languages or internationally. In an AI simulation, AI conducts the calls.
Additional services
Through our partner network, we offer additional awareness and security programmes to complete your security strategy. These include targeted email phishing simulations, interactive e-learning, tailored training, in-depth technical penetration tests and physical mystery visits to your sites.
From intake to insight
Intake
We discuss your organisation, your risk profile and which scenarios are most relevant to your context.
Scenario development
Tailored assessments based on current attack techniques and your internal processes and structures. On request, extended with multi-vector scenarios, including phishing emails.
Execution
The assessments are carried out by experienced specialists. Realistic, professional and fully within the agreed boundaries. During the assessments, internal processes and verification procedures are tested.
Reporting & final presentation
Within five working days after the last vishing call, you will receive a clear report with findings, risk analysis and concrete recommendations. Followed by a final presentation via video call.
Lara is able to set up realistic and credible social engineering scenarios and carry them out in a convincing and professional manner. What makes her strong is the combination of practical experience, strong conversational skills and a sharp insight into how processes, communication and decision-making really work in organisations.
Joyce de Jong
Director, Audittrail
Expertise that makes the difference
Expertise in execution
More than ten years of experience in social engineering and information security. DeepCalls works exclusively with experts in information security and privacy, with a proven track record at leading organisations.
Credible down to the detail
Credible scenarios require more than a script. DeepCalls works with different profiles, roles and dynamics to replicate a realistic attack, extended where relevant with multi-vector scenarios including phishing emails and follow-up emails.
Scalable where needed
For large-scale, multilingual or international campaigns, DeepCalls also offers AI simulations. In these, AI conducts the calls.
Fully within boundaries
All assessments are carried out on the basis of signed authorisation and documented rules of engagement. Confidential, GDPR-compliant and without operational disruption.
Latest articles
16 Oct 2026
Scattered Spider and your service desk: what the CISA advisory means
CISA and the FBI warn that Scattered Spider uses IT helpdesks to take over accounts. What the advisory says and what it means for your service desk.
16 Oct 2026
The Cyberbeveiligingswet (the Dutch Cybersecurity Act) and your service desk
Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act) has been in force. What does the act require of the board, and does your MFA hold up when someone calls the service desk?
16 Oct 2026
What is account takeover via the service desk?
With one phone call to the service desk, an attacker can take over an account. What account takeover is, why MFA does not stop it and what you can do.
Curious how resilient your organisation is?
Schedule an introductory call and discuss which assessment fits your risk profile.
Get in touch