RedLine — Voice-Phishing Drill Coach

Most breaches start with a phone call, not a firewall gap — a fake "IT helpdesk" asking for your code, a "fraud team" that needs it right now, a "CEO" demanding an urgent wire. Yet security-awareness training is still slides and quizzes; nobody practises the actual call. RedLine turns that into a three-minute, repeatable drill. Your phone rings with a spoofed caller ID that looks trusted, and an AI social engineer calls you. It greets you by name, builds a believable pretext, and escalates when you push back — talking like a real person, not a bot. You practise saying no, out loud, in real time. It's built on the AssemblyAI Voice Agent API: one WebSocket carries streaming speech-to-text (Universal-3 Pro), the LLM, the voice, and turn-taking. The attacker is configured live per call and carries no tools, so nothing technical is ever spoken. In the background, a separate model on the AssemblyAI LLM Gateway reads the transcript as it unfolds and tags the persuasion tactics being used on you and the good security moves you make — powering a live tactic radar, coach hints, and a resilience score, without the caller knowing the coach exists. A deterministic detector independently checks every line against your practice screen, catching even spoken digits, so a leak can't be talked away. Extra realism: a telephone-band audio filter, adaptive difficulty that escalates when you resist well, a score history and streak, and an annotated call timeline that ends by revealing the caller ID was spoofed. A consent-first admin console extends it to real phones — invite by SMS, reply YES to opt in, then a disclosed training call — refusing any call to a number that hasn't consented. Only fake practice values are ever used, and saying "red line" stops any drill. RedLine is voice AI turned around: an agent that attacks, so people learn to defend.