Most MSP phishing programs test one thing: whether an employee clicks a fake email. That's a start — but it's not a security program. It's a simulation of one attack vector in a threat landscape that now spans five.
The attackers targeting your clients' employees don't limit themselves to email. Business email compromise, SMS smishing, AI voice calls, QR code phishing, and credential harvesting pages are all live, active threat vectors in 2026 — and each requires its own simulation methodology. An MSP running email-only phishing tests is leaving four attack surfaces untested and untrainable.
This article breaks down each of the five attack types, what makes them dangerous, and what effective simulation looks like for each. The coverage gap between what most MSPs test and what attackers actually use is where breaches happen.
The 5 attack types every MSP must simulate: BEC (CEO/CFO impersonation), smishing (SMS phishing), vishing (AI voice calls), quishing (QR code phishing), and credential harvesting (fake login pages). Email-only simulation programs miss 4 of 5 active attack vectors. Multi-vector coverage is the 2026 baseline.
Why MSPs Need Multi-Vector Phishing Simulation (Not Just Email)
Email phishing click rates have declined steadily as email security gateways have improved and employees have been trained on classic indicators — suspicious sender addresses, urgent language, spelling errors. Attackers adapted. They moved to channels where defenses are weaker and employees are less trained.
The shift is measurable. SMS smishing click rates now exceed email phishing click rates in most SMB verticals. Voice phishing — particularly AI-generated voice calls that mimic executives — has a social engineering success rate that dwarfs text-based attacks. QR code phishing bypasses email security scanning entirely because the malicious URL is embedded in an image, not a link. Credential harvesting pages have become indistinguishable from the real login pages they spoof.
For MSPs, the implication is straightforward: if your phishing simulation program doesn't cover all five vectors, you're producing data on one attack surface and leaving clients exposed on four others. Worse, you're providing documented "training" that won't hold up under a cyber insurance claim when the breach happens through a vector you never simulated.
The 5 Attack Types MSPs Must Simulate
BEC is the highest-dollar attack type in cybercrime, responsible for over $2.9 billion in losses to U.S. businesses annually according to FBI IC3 data. Unlike commodity phishing, BEC is targeted: an attacker impersonates a company executive (usually the CEO or CFO) and requests an urgent financial action — a wire transfer, a gift card purchase, an invoice approval, or a payroll redirect.
What makes BEC effective is its simplicity. The best BEC attacks don't contain malicious links or attachments at all — they're plain-text emails from a spoofed or lookalike domain requesting a legitimate-seeming business action. They bypass email security gateways that scan for malware. They exploit authority, urgency, and the human instinct to comply with executive requests.
What effective BEC simulation looks like:
- CEO-to-finance impersonation: "I need you to process an urgent wire transfer before EOD — I'm in meetings, call me if you need approval"
- CFO-to-accounting: spoofed invoice approval request from a vendor the client actually uses
- IT-to-employee: credential reset request that appears to come from the internal IT team
- Difficulty calibration: start with obvious spoofed domains, progress to lookalike domains (company-secure.com vs company.com)
BEC training must teach employees to verify financial requests via a secondary channel — phone call, Slack message, physical confirmation — regardless of email urgency. The training landing page employees see after clicking should reinforce this specific behavior, not generic phishing awareness.
SMS phishing (smishing) is the fastest-growing attack vector in the SMB space. Click rates on smishing messages are consistently 2–3x higher than equivalent email phishing attempts. The reasons are structural: people are conditioned to trust SMS as a secure channel, messages arrive on personal devices outside corporate security controls, and most employees have received zero training on SMS-based threats.
The most effective smishing templates in 2026 fall into two categories. The first is fake MFA notifications: "Your Microsoft authenticator needs to be reactivated. Tap here to verify your account." The second is delivery/logistics notifications: "Your package requires customs verification — confirm your details here." Both leverage urgency and legitimate-seeming contexts that employees encounter in their actual daily lives.
What effective smishing simulation looks like:
- Fake MFA re-enrollment: "Action required: your Microsoft 365 authentication method has expired"
- Package delivery fraud: "Your delivery was held — confirm your address to reschedule"
- Bank/payment alert: "Unusual activity detected on your business account — verify now"
- IT helpdesk: "Your VPN certificate expires tonight — click here to renew"
Smishing simulation requires a different delivery infrastructure than email — SMS sending capabilities with trackable short links. The training outcome is also different: employees need to learn to verify SMS requests through official apps or direct phone calls, never through links in the SMS itself.
Voice phishing has existed for decades, but AI voice synthesis changed its effectiveness profile entirely in 2024–2026. Modern vishing attacks use AI-generated audio that mimics the voice of a specific executive — generated from publicly available audio (LinkedIn videos, company podcasts, earnings calls) — to make requests that employees are far more likely to comply with than a text message or email.
The attack pattern is simple: a call arrives appearing to be from the CEO, CFO, or IT director. The AI voice says "I'm in a restricted meeting — I need you to handle something urgently" and proceeds to request credentials, wire transfers, or remote access. Employees who would recognize a phishing email often don't have a mental framework for questioning a voice they recognize.
What effective vishing simulation looks like:
- Simulated IT helpdesk call: "I'm calling from TechSupport — we're seeing suspicious logins on your account and need you to verify your credentials"
- Executive impersonation: AI or human caller simulating CEO requesting urgent action outside normal process
- Vendor fraud: caller claiming to be from a software vendor requesting account access for "emergency maintenance"
- Post-simulation debrief: what verification steps should employees use before complying with any phone request?
Vishing training should focus on one behavioral change: employees must always verify unexpected phone requests through an established callback number — never the number the caller provides. Simulations that reinforce this specific protocol are more effective than general awareness training about voice fraud.
QR code phishing — quishing — is the attack type that most completely bypasses traditional email security controls. Because the malicious URL is embedded in a QR code image rather than a clickable link, email security gateways that scan for malicious URLs don't flag quishing emails. The user scans the code on their phone (often a personal device without corporate security controls), which opens the malicious URL in the phone's browser outside any corporate monitoring.
The physical attack vector is particularly effective: printed QR codes placed in conference rooms, lobbies, or break rooms claiming to be the office WiFi or a payment terminal. Employees scan these without any of the suspicion they'd bring to an email link. In the digital form, quishing emails typically claim to contain a "secure document" or "payment receipt" that requires QR code verification.
What effective quishing simulation looks like:
- Email-based: "Scan to access your secure document" or "QR code verification required for your benefits enrollment"
- Physical: simulated QR code posters placed in common areas claiming to be WiFi access or printer setup
- Conference room attack: QR code in meeting rooms labeled as the room AV system or video conferencing setup
- Training outcome: employees should never scan QR codes from unknown sources — verify with IT before scanning any physical QR code in the office
Most phishing simulation platforms don't support physical quishing scenarios. Physical QR code placement is a high-value simulation that very few MSPs currently offer, which represents both a gap in client security and a service differentiation opportunity.
Credential harvesting is the classic phishing attack type — and it remains the most common. An employee clicks a link (in an email, SMS, QR code, or via social engineering) and is directed to a fake login page that mimics Microsoft 365, Google Workspace, a VPN portal, or another credential target. They enter their username and password. The attacker captures the credentials and logs in to the real service.
In 2026, credential harvesting has evolved beyond simple fake login pages. Adversary-in-the-Middle (AiTM) attacks proxy the real Microsoft or Google login page in real time, capturing session tokens that bypass MFA entirely. Employees who click and see what appears to be the familiar Microsoft sign-in page — because it actually is — have essentially no behavioral signal that they're being attacked.
What effective credential harvesting simulation looks like:
- Microsoft 365 login page: triggered by "Your password has expired" or "Unusual sign-in activity detected" email
- Google Workspace: "Your Google account requires verification" landing on a convincing Workspace login clone
- VPN portal: "Your VPN certificate has been revoked — re-authenticate to maintain access"
- Difficulty progression: start with obvious red flags (wrong domain), progress to convincing lookalike domains, advanced to AiTM proxy demonstrations
Training for credential harvesting must instill URL inspection as a habit — checking the browser address bar before entering any credentials. This single behavior, consistently applied, prevents the vast majority of credential harvesting attacks. Simulations should measure not just whether employees enter credentials, but whether they check the URL first.
Multi-Vector Coverage: What MSPs Are Testing vs. What Attackers Are Doing
Here's a realistic picture of where most MSP phishing programs sit today versus what comprehensive coverage looks like:
| Attack Vector | MSPs Simulating It | Employee Training? | Breach Risk if Untested |
|---|---|---|---|
| Email phishing | ✓ ~70% of MSPs | ✓ Usually | Moderate (email defenses are strongest) |
| BEC / executive impersonation | ✗ ~30% of MSPs | ✗ Rarely | High — no link to block, no malware to detect |
| SMS smishing | ✗ ~15% of MSPs | ✗ Almost never | Critical — 3× click rate, zero employee training |
| Voice vishing | ✗ ~8% of MSPs | ✗ Almost never | High — AI voice makes verification instinct critical |
| QR code quishing | ✗ ~5% of MSPs | ✗ Almost never | High — bypasses all email security controls |
| Credential harvesting | ✓ ~55% of MSPs | ✓ Sometimes | Critical — 82% of breaches involve stolen credentials |
The pattern is clear: MSPs have concentrated their simulation programs on the attack vectors with the strongest existing defenses (email) and left the highest-click-rate, lowest-defense vectors (smishing, vishing, quishing) completely uncovered.
How ThreatPulse Simulates All 5 Attack Types with AI-Adaptive Difficulty
Most phishing simulation platforms were built when email was the only vector that mattered. Adding SMS or voice simulation to these platforms is an afterthought — limited template libraries, separate reporting systems, no unified employee risk score across vectors.
ThreatPulse was architected for multi-vector simulation from the ground up. Every attack type — BEC, smishing, vishing, quishing, and credential harvesting — runs from a single platform, with unified reporting, a single employee risk profile, and AI-adaptive difficulty that adjusts across all vectors simultaneously.
One platform. All attack surfaces. AI difficulty that adapts per employee.
BEC simulation: AI-generated spear phishing emails that impersonate the client's actual executives, using real company context (names, roles, departments) pulled from the client profile. Difficulty scales from obvious spoofed domains to convincing lookalike domains with proper DKIM signatures.
Smishing simulation: SMS phishing campaigns that reach employees on their registered mobile numbers. Template categories include MFA re-enrollment, package delivery, IT alerts, and banking notifications. Click tracking works through short-link redirection on mobile browsers.
Vishing simulation: Automated voice calls with AI-generated scripts tailored to the client's industry and the employee's role. Finance employees get CFO impersonation scripts. IT employees get vendor support calls. Calls are recorded (with consent where required) and outcomes tracked per employee.
Quishing simulation: QR code phishing campaigns delivered via email and — for MSPs who want physical scenario testing — printable QR code assets for office placement. Landing pages after scan are fully tracked for mobile browser access patterns.
Credential harvesting: High-fidelity replica login pages for Microsoft 365, Google Workspace, VPN portals, and custom applications. Tracks URL inspection behavior — not just whether credentials are entered, but whether employees checked the address bar first.
- AI-adaptive difficulty: employees who haven't clicked in 3 months automatically receive harder scenarios; recent clickers get immediate targeted follow-up
- Unified employee risk score across all 5 vectors — one number that captures total social engineering susceptibility
- Automated remediation: clickers receive vector-specific micro-training within 60 seconds of clicking, on the device they used
- MSP portfolio view: risk trends across all clients in one dashboard
- No seat minimums — $1.50/user/month, monthly billing
The practical difference for MSPs: instead of running email-only campaigns manually and generating click rate reports, ThreatPulse runs all five attack vectors on schedule, adapts difficulty automatically, delivers remediation training without manual intervention, and produces reports suitable for client QBRs and cyber insurance documentation.
The Bottom Line
Email phishing simulation was the right starting point. In 2026, it's a floor — not a ceiling. The five attack vectors your clients face (BEC, smishing, vishing, quishing, and credential harvesting) each require their own simulation scenarios, their own training outcomes, and their own remediation loops. A program that tests one and skips the other four is producing incomplete risk data and leaving documented gaps that attackers actively exploit.
Multi-vector phishing simulation isn't a premium add-on for enterprise clients. It's the minimum viable security awareness program for any SMB that faces real threat actors — which, in 2026, is all of them.
For MSPs looking to close the coverage gap without multiplying their operational overhead, ThreatPulse runs all five attack types from a single platform with AI-adaptive difficulty across your full client portfolio. The pricing page shows how the per-user model works at different client volumes.
Start a Free Phishing Simulation — All 5 Attack Types
BEC, smishing, vishing, quishing, and credential harvesting — AI-adaptive campaigns across every attack vector, for all your MSP clients. No seat minimums. No annual contract.
Get the MSP Security Playbook
Weekly tips on running phishing simulations for your MSP clients. No spam.