Voice Drill: test bank voice authentication against human-sounding speech models

The two ideas are in very different places. The voice agent test caller is already a crowded category. Cekura, Hamming, Coval, Future AGI and RedCaller all offer simulated or adversarial callers for AI voice agents, and Cekura already sells red teaming. A new entrant there could only win as a banking-specific layer: scenario packs for account takeover, elder-fraud and confused-customer cases, scoring against bank policy such as Reg E, UDAAP and callback rules, and audit-ready evidence for model risk teams. That layer is easy for the incumbents to copy. The authentication drill has more room. I found no product that runs scheduled, consented synthetic calls against a bank's live IVR voiceprint checks and human agents, and that reports voiceprint pass rates and how well agents follow callback and contact-change rules. Breacher.ai targets internal help-desk and finance workflows. Awareness vendors like Arsen and Adaptive train employees but do not measure customer-authentication controls. Detection vendors like Pindrop recommend testing but sell detection. Demand looks real: credit union and banking trade press report synthetic voice attacks up about 20 times in a year, and about 25% of institutions report a deepfake incident. The best opening is probably a credit union and regional bank niche. Such a product would clone voices of consenting members or staff, attack the same pattern seen in the wild (IVR reconnaissance, an attempted voiceprint bypass, then social-engineering an agent into changing an address or phone number), and produce scorecards suitable for examiners and boards. Three risks stand out. Pindrop, Nuance or Microsoft, and the awareness vendors could add this as a feature. Telecom and consent law makes synthetic calls into production lines complicated. Banks' voice biometric vendors may restrict or object to third-party bypass testing, so partnering with those vendors may matter more than going it alone.

• Breacher.ai

  Sells deepfake red teaming that uses voice clones and live deepfake video. Its targets are internal finance, HR and help-desk workflows such as wire approvals, password resets and vendor bank-detail changes, not customer-facing IVR voiceprint checks. It is the closest thing to the authentication drill idea.

• Cekura

  Voice agent testing and monitoring platform with a red-teaming product that claims more than 32,000 adversarial scenarios. It also handles IVR navigation and offers VPC deployment. This directly covers the voice agent test caller idea.

• Hamming

  Runs large numbers of simulated phone calls against AI voice agents before launch. The use cases I found were general ones like scheduling and ordering, with no banking focus.

• Coval

  Generates synthetic callers across thousands of scenarios to regression-test voice agents in CI/CD. Developer-led and horizontal, not built for banks.

• RedCaller

  Automated red-teaming framework for phone-based voice AI agents that tests for prompt injection and social engineering. Built by SecureCoders, who also released the open-source VoiceGoat, a deliberately vulnerable voice agent.

• Future AGI

  Agent evaluation vendor that publishes red-teaming methods for voice agents covering eight attack types, with pre-launch call simulation.

• Arsen

  AI vishing simulation with adaptive synthetic voices for training staff. Aimed at employee awareness, not at testing customer authentication.

• Adaptive Security, Hoxhunt, Brightside AI, Jericho Security

  Security awareness platforms that include deepfake voice simulations. Adaptive Security also publishes guidance on deepfakes against customer service, so it could move into contact-centre agent drills.

• Pindrop

  The leading contact-centre voice authentication and deepfake detection vendor. It tells call centres to test their defences against deepfakes and is well placed to bundle testing with its detection products. It is also a possible partner or acquirer.

Checked 2026-10-25