Setting Up Attack Strategies

After you create your persona, you build the attack strategy. A strategy defines how your deepfake simulation reaches your targets—and what happens when they respond.

Emma Francey
2 steps
4 seconds

Breacher

## Core Concept: One Strategy, Multiple Delivery Methods You can execute the same core attack scenario through different channels. This mirrors how attackers work in the field. **Example Strategy:**\ Someone impersonating the CEO calls to change their MFA phone number. **Three Ways to Execute:** ### 1. Microsoft Teams Video Call - Send a meeting invite that appears to come from Microsoft Teams - Target clicks the link and joins a video room - Your deepfake persona (in this case, Henry McMalley) appears on video - The persona requests the MFA number change during the call ### 2. Phone Call + Voicemail - Jason (your persona) leaves a voicemail or sends a call-back link - Target calls into the platform - Jason answers and attempts to get the MFA number changed - Conversation happens entirely through voice ### 3. Zoom Video Call - Similar to Teams approach - Uses Zoom's familiar interface - Target joins what appears to be a legitimate Zoom meeting - Persona conducts the attack via video ## Building Multi-Stage Attacks You can combine individual strategies into templates that create complex, realistic attack sequences. **Single-Stage vs. Multi-Stage:** A single strategy runs one simulation. A multi-stage attack chains multiple touchpoints together—just like sophisticated attacks happen in practice. **Multi-Stage Example:** 1. Email arrives with urgent request 2. Follow-up SMS reinforces the message 3. Phone call comes in from "the CEO" 4. Target calls back and engages with the deepfake agent 5. Video meeting invite arrives as final pressure point Each stage builds on the previous one, creating pressure and urgency that mirrors actual social engineering attacks. ## Why This Matters This flexibility lets you test your people against the exact techniques attackers use. You can: - Match your simulations to your threat profile - Test different communication channels - See which attack vectors your team falls for - Build progressive difficulty into your training

## Next Steps When you create these strategies, think about how an attacker would approach your organization. ### Start With Your Threat Profile Ask these questions before you build: **Who are your high-value targets?** - Finance team members who process wire transfers - IT admins with system access - Executive assistants who manage calendars and travel - HR staff who handle sensitive employee data **What would an attacker want from them?** - Payment redirections - Credential resets - Calendar access to plan attacks - Employee personal information for further targeting **Which communication channels does your organization trust?** - Do people jump on Teams calls without verification? - Does your team return voicemails from "executive" numbers? - Do employees click Zoom links in emails without checking the sender? ### Build Progressive Difficulty Don't start with your hardest scenario. Build awareness through stages: **Phase 1: Single-Channel, Clear Red Flags** - One touchpoint (email or call) - Obvious urgency language - Basic impersonation - Goal: Establish baseline awareness **Phase 2: Multi-Channel, Subtle Pressure** - Two or three touchpoints (email + voicemail, or SMS + call) - More realistic timing and language - Better persona research - Goal: Test if people verify when pressure increases **Phase 3: Full Attack Chain** - Complete sequence mimicking sophisticated attacks - Multiple communication channels - Time pressure and authority combined - Goal: Reveal who needs additional coaching ### Map to Real Attack Patterns Base your scenarios on attacks that actually work: **Wire Fraud Pattern:** 1. Email from "CFO" mentions upcoming payment 2. Follow-up call requests expedited processing 3. Zoom meeting confirms "urgent" details 4. Target processes fraudulent payment **Credential Compromise Pattern:** 1. Voicemail from "IT Security" about account issue 2. Target calls back into platform 3. Agent requests MFA reset "for security" 4. Target provides access **Executive Impersonation Pattern:** 1. SMS from "CEO" during off-hours 2. Urgent request to join Teams call 3. Video meeting with deepfake persona 4. Request for sensitive information or action ### Test Your Actual Workflows Simulate attacks against your specific processes: - If you process payments via email approval, test that - If your IT team resets MFA over the phone, test that - If executives schedule video calls through assistants, test that The goal is to find gaps in your actual procedures—not theoretical ones.

Setting Up Attack Strategies

After you create your persona, you build the attack strategy. A strategy defines how your deepfake simulation reaches your targets—and what happens when they respond.

Emma Francey
2 steps
4 seconds

Breacher