Your clients already budget for training. Upgrade it to a live attack exercise.
Diopter gives you both sides of social engineering defense. Agentic red team exercises put your clients' help desks, finance teams and executives through a full attack chain, on the training budget they already have. Real-time defense on Teams, Zoom, Google Meet and RingCentral calls then covers what the exercise exposed.
Run your first exercise on your own help desk, free, before you put it in front of a client.
Red team
Agentic attack exercises against your clients' people, scoped per engagement.
Blue team
Real-time defense and policy checks on Teams, Zoom, Google Meet and RingCentral.
Your price
You set what your clients pay for both.
Run it on your own help desk first.
- 01
We run one exercise against your desk
You pick the target and sign the authorization, the same one a client would.
- 02
You read your own report
What was asked, what your team did, which rule bent. By team, never by name.
- 03
Then you sell it
With a statement of work you bill and keep, and a founder on your first client call.
Founding partners also get not-for-resale seats, so live defense runs on your own calls before it runs on anyone else's.
Upgrade what you already sell as training.
SOC 2 auditors
A security awareness training program is a point of focus under CC2.2, and auditors commonly look for one.
AICPA Trust Services Criteria, CC2.2 points of focus (2022)New York DFS
“at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel”
23 NYCRR 500.14(a)(3), as amended November 2023Bank examiners
“Training programs should include scenarios capturing areas of significant and growing concern, such as phishing and social engineering attempts”
FFIEC IT Examination Handbook, Information Security, II.C.7(e)The FTC Safeguards Rule
Requires security awareness training for tax preparers, mortgage brokers and other non-bank financial firms.
16 CFR 314.4(e)(1)HIPAA
“Implement a security awareness and training program for all members of its workforce (including management).”
45 CFR 164.308(a)(5)(i)Cyber insurers
“How often do you conduct interactive social engineering (i.e., phishing) training?”
Beazley Cyber Insurance Application, question 8
Diopter doesn't certify compliance. Your client's auditor, examiner or insurer decides how an exercise counts.
Exercises that run the attack, start to finish.
- 01 · Recon
Maps the target
Finds who works there, who runs IT and how the help desk is reached, from public sources.
- 02 · Pretext
Calls as an employee
An AI caller phones the help desk as a real member of staff, with a reason to hurry.
- 03 · The reset
Asks for access
Pushes for a password reset, then for a new device on the account's MFA.
- 04 · The report
Shows where it held
Records which steps the desk refused and which it gave away, by team.
Executive impersonation
A synthetic executive asks finance to move funds outside the business.
Data exfiltration
A believable pretext to get client files, payroll or customer data sent out.
Attack surface mapping
Maps the whole organization's public footprint and the weak points an attacker would use first.
What your client gets
- An exercise report they can hand an auditor or insurer
- Results by team, never by name
- People who have faced an agentic attack before a real one arrives
Start on the training budget. Grow into live defense.
- 01
Land
Sell red team exercises as the upgrade to the awareness training your client already buys.
- 02
Show
The report shows which teams gave way: the help desk, finance, the executive assistants.
- 03
Expand
Put live defense on those teams' calls. The next exercise shows what changed.
Defend the calls where the money moves.
Blue team, on the call
Diopter connects to the client's call platform: Microsoft Teams, Zoom, Google Meet or RingCentral. It checks the voice and video for synthetic media, the conversation for pressure, and the request against the client's own rules, then returns one verdict with a recommended action.
Connecting the platform covers every one of their people at once and puts nothing on a workstation. For a pilot on a single team, or a call system we haven't built yet, there is a macOS desktop app instead. Other call systems can be scoped as an integration.
Alerts route by severity to email, Microsoft Teams, Slack or a webhook.
- Low RiskA minor signal, logged for review.
- SuspiciousWorth a second look before anyone acts.
- High RiskPause the request and verify it another way.
When too little was captured to reach a verdict, it says Inconclusive rather than giving an all-clear.
Already reselling a training platform?
Awareness courses
What it coversTeach people what an attack looks like.
What Diopter addsExercises put them through one, by phone and on video, from first contact to the ask.
Phishing simulation
What it coversTests the inbox with a fake email.
What Diopter addsExercises test the help desk, finance and executives on calls, where access and money move.
Help desk caller verification
What it coversConfirms an enrolled caller before a reset.
What Diopter addsExercises test whether the desk holds to it under pressure. Live defense covers callers nobody can enroll.
Give your client something to hand their carrier.
“How often do you conduct interactive social engineering (i.e., phishing) training?”
Beazley cyber insurance application, question 8, read in the primary source 9 Oct 2026Your client's cyber renewal asks how often they run interactive social engineering training. An exercise is a dated answer to that question with the work behind it.
- 01
A dated record
What was tested, when, and how each team did. Written for someone outside the security team to read.
- 02
A re-test
The same attack after the client fixes what it found, so the second date shows movement.
- 03
Facts your client can stand behind
The attestation on the application is theirs to make. You are the one who can put something behind it.
Coverage, pricing and the application itself stay with your client, their broker and their insurer. Diopter doesn't certify compliance and doesn't price risk.
Built for MSPs whose clients move money and answer to auditors.
- 01
Community banks and credit unions
Examiners expect social engineering scenarios in training. Wire desks and help desks are the first targets.
- 02
Title, escrow and settlement
Closing funds and payoff instructions confirmed on a call days before the money moves.
- 03
Funds and family offices
Small teams approving capital calls and distributions, often with a partner joining on video.
- 04
RIAs and wealth managers
Clients asking advisors to move money, and callers who only sound like those clients.
- 05
Compliance and vCISO practices
Exercise reports and policy checks add evidence to the programs you already run for clients.
- 06
Accounting and CPA firms
Tax preparers fall under the FTC Safeguards Rule, which requires security awareness training.
Mostly generalist SMB clients? We're not the right fit yet, and we'd rather say so now.
Run it across every client you manage.
What your team runs
- Multi-tenant configuration built for resellers
- Exercise reports by team, for the client's file
- Alerts by severity to email, Teams, Slack or a webhook
- SSO and OIDC enforcement
- Audit log with CSV export
- Consent controls: bot disclosure and capture notices
What the security review asks
- SOC 2 Type II verified: audited by Sensiba, 1 July to 30 September 2026, report under NDA
- ISO 27001 in progress
- No biometric templates stored for anyone on a call
- On-prem deployment and retention down to zero
- If Diopter fails, the call carries on
- Built by the team behind QuillBot
Who does what.
Two things we sell, and the line between your team and ours on each.
A red team exercise
You hold the client relationship, agree the scope with them and present the report.
We write the authorization, place every call, and write up what happened.
Live defense
Your techs get the alert where they already look, and decide what happens next.
We score the voice, the video and the request, and raise the verdict mid-call.
Diopter never removes a participant, never blocks a call and never sits inline. If it fails, the call carries on and you lose the alert, not the meeting.
Set the price your clients pay.
You get
- A free first exercise against your own help desk, then your first client's
- Not-for-resale seats for your own team
- Founder access in a shared Slack or Teams channel
- Hands-on help with your first exercises and deployments
- A statement of work template you bill and keep
- Deal registration
We ask
- A first client live within the window we agree
- Check-ins at day 30, 60 and 90
- A reference, if it works for you
You set the client price for both. We don't publish partner pricing, so your clients never see your cost. Registered partners get Diopter pricing on the fit call.
Apply for the founding cohort.
- 01
Apply
Tell us about your firm on the contact form.
- 02
Fit call
30 minutes with a founder: margin at your markup and client count, then the partner terms.
- 03
Agreement
A short partner agreement, then seats for your own team.
- 04
First client
Your first exercise or deployment, with a founder alongside and the statement of work in hand.
Rather see it run first?
What MSPs ask first.
What can we sell today?
Both sides. Live defense runs on Microsoft Teams, Zoom, Google Meet and RingCentral calls, with policy checks and a three-level verdict. Red team exercises are sold as a scoped engagement rather than a per-seat licence: help desk vishing, executive impersonation, data exfiltration and attack surface mapping.
How do our clients pay for this?
Most start on the line they already have for security awareness training. Red team exercises are the upgrade to it, and the report records what was tested and how each team did. Live defense can follow once an exercise shows which teams gave way.
Does an exercise satisfy SOC 2, HIPAA or NYDFS?
No exercise satisfies a framework on its own, and Diopter doesn't certify compliance. Several frameworks require training that covers social engineering, and the exercise report documents what was tested and how each team did. Your client's auditor or examiner decides how it counts.
Will this lower our clients' cyber insurance premiums?
We don't claim that, and we'd be making it up if we did. What we can say is that cyber applications ask how often a client runs interactive social engineering training, and an exercise report is a dated answer to that question. Coverage, pricing and the application stay with your client, their broker and their insurer.
Can we run it on ourselves before selling it?
Yes, and we'd rather you did. Your first exercise can run against your own help desk, free, on the same authorization a client would sign. Founding partners also get not-for-resale seats so live defense runs on your own calls first.
Do we have to drop the training platform we resell today?
No. Exercises are the upgrade on the same budget line, and they work alongside the courses and phishing simulations you already deliver.
Why isn't partner pricing on this page?
So your clients never see your cost. You set the client price, and registered partners get partner pricing and terms on the fit call.
What do my techs install, and on which operating systems?
Nothing on client machines in the usual setup. Diopter connects to the client's call platform (Microsoft Teams, Zoom, Google Meet or RingCentral), which covers every one of their people at once. A macOS desktop app is the lighter second path, for a pilot on one team or a call system we haven't built yet. Other call systems can be scoped as an integration. We'll agree the right setup for each client on the fit call.
Does it work with my PSA?
There is no native PSA integration today. Alerts route by severity to email, Microsoft Teams, Slack or a webhook, so they can land wherever your techs already look.
Is this employee monitoring?
No. Exercise results come back by team, never by name, and live defense gives the security team aggregate insight, never a ranking of individual employees.
Do my clients' employees need to consent?
Diopter includes consent controls for live defense: meeting bots disclose themselves, and capture notices are configurable. Recording consent law varies by state and country, so each client sets these to match its own obligations.
What happens if Diopter misses something or goes down?
The call continues. Diopter never removes a participant, never blocks a call and never sits inline, so losing it costs you the alert, not the meeting. When too little was captured to reach a verdict, it says Inconclusive rather than giving an all-clear.
Can we run it on our own team first?
Yes. Founding partners get not-for-resale seats for their own team, so you can run Diopter on your own calls before you put it in front of a client.
Where does call data go, and how long is it kept?
Retention is configurable, down to zero data retention, with data residency options and on-prem deployment available. No biometric templates are stored for anyone on a call.