A Gartner survey reported that 41% of CISOs saw audio deepfakes and 36% saw deepfake video calls targeting their organisations in the past year. Gartner says the attacks combine familiar social engineering techniques with synthetic media and recommends shifting verification practices and strengthening identity controls.
Gartner: AI boosts volume, personalization, and credibility of social engineering while reducing reliability of traditional detection cues.
Practical defenses include training employees to verify consequential requests, using phishing-resistant authentication, and updating incident response playbooks for multimodal impersonation.
Detect identity abuse by correlating suspicious communications with account recovery, new devices, privilege changes, and financial transactions.
# What happened
A Gartner survey of senior cybersecurity leaders found substantial use of synthetic audio and video in social engineering attacks during the previous 12 months. According to the survey summary cited by KnowBe4, 41% of CISOs reported at least one audio deepfake targeting their organisation, and 36% reported deepfake video calls aimed at employees.
Craig Porter, Director Analyst at Gartner, described how attackers now blend traditional social engineering with synthetic media and aggregated personal context across channels. He said most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods.
# Why it matters
Deepfakes raise two practical problems for defenders. First, synthetic audio and video increase the credibility of impersonation attacks and make cues people used to rely on less reliable. Second, these attacks are multimodal: they can arrive by e-mail, voice, video, collaboration apps, or even AI applications, making detection and response more complex.
# Gartner's recommended steps (actionable items)
# Practical implications for security teams
Security teams should treat deepfake-enabled social engineering as an evolution of existing human-targeted attacks rather than a wholly new category. The core defensive focus remains identity, authentication, recovery processes, and user behavior — but executed with more discipline and broader coverage across channels.
# What to watch next
Expect more incidents combining phishing, business email compromise, synthetic media, and aggregated personal data. Organisations that leave recovery processes, identity controls, or verification practices unchanged are more exposed to repeatable, high-impact fraud. Incident response playbooks should be revised to cover multimodal attacks and the possibility of manipulated AI agents.
Gartner warns that CISOs must update incident response playbooks as AI-powered deepfakes make social engineering attacks more convincing and harder to detect
A quarter of victims of deepfake attacks have lost over $1m. CISOs worry that boardrooms don’t understand the threat
AI tools are drastically improving the speed of the reconnaissance stage of targeted social engineering attacks, according to researchers at ESET. Attackers can use these tools to trawl the internet for publicly available information about potential victims, and incorporate this information into personalized spear phis
Threat actors are increasingly leveraging AI hallucinations to plant phishing links and other malicious content in AI output, IEEE Spectrum reports. Large language models (LLMs) sometimes fabricate information, including web domains, when answering users’ questions. Attackers are registering these hallucinated web doma
Researchers at Gen Digital are tracking a sophisticated social engineering campaign that’s using phony NDA documents to trick employees into moving the conversation to WhatsApp and personal email accounts. The attackers targeted an employee at Gen itself, but the employee recognized that it was a scam and played along
Threat actors’ abuse of enterprise collaboration tools increased fourfold over the past twelve months, according to researchers at Palo Alto Networks’ Unit 42.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.