Social engineering is a form of cybercrime in which attackers manipulate people into revealing confidential information or taking actions that compromise security. Artificial intelligence is making these attacks increasingly convincing, for example by generating highly realistic messages, cloning voices, or creating deepfakes. While working at Munich-based decacorn Celonis (a startup valued at more than €10 billion), founder Tom Müller and his future co-founders Julius Muth and Robert Seilbeck began exploring this development. They recognized a growing gap between attackers' capabilities and conventional security awareness training.
“Attackers are using AI to imitate people convincingly, while traditional awareness training still relies on the annual phishing email,” Müller explains. This gap became the starting point for revel8.
The training platform takes an individualized approach. Müller describes it as “a Spotify playlist for cyberattacks.” Drawing on real-world attacks gathered through its threat intelligence, the platform creates personalized training programs for individual employees. These combine attack simulations, short learning sessions, and targeted nudges. The content is tailored to each person's role, publicly available information, and previous behavior. Both frequency and difficulty are continuously adapted.
Training for attacks across multiple channels
Teams. It also covers phone calls using cloned voices and deepfakes in video conferences. A typical scenario might involve someone posing as the CEO and asking an employee to authorize an urgent bank transfer.
The results demonstrate the potential of this approach. At Zufall Logistics Group, training completion rates increased from 83 to 96 percent within just two months. The company also expanded its attack simulations beyond email to include Teams, SMS, and calls using cloned voices. In addition, revel8 has trained more than 40 contact centers at a global insurance company to recognize voice phishing and social engineering. According to Müller, eight of Germany's 40 DAX-listed companies now use the platform.
Growing with the CISPA community
The challenges have changed as the company has grown. Initially, the main priority was acquiring the first customers and convincing large corporations to put their trust in a young startup. Today, the focus is on scaling the organization to keep pace with customer demand and a rapidly evolving market.
Müller describes the collaboration with CISPA as excellent. He particularly values the opportunity to exchange ideas with fellow founders and researchers working on similar challenges.
Looking ahead, revel8 aims to move beyond security awareness and build a platform for workforce risk management in the age of AI. Companies increasingly rely not only on human employees but also on AI agents, for example to interact with customers. These systems can become targets of cyberattacks, too.
“Our goal is to make the risks across the entire workforce visible and reduce them, from human employees to AI agents,” Müller explains, summarizing the startup's vision.
For more information, visit: https://www.revel8.ai
