CISOs Must Update Incident Response Playbooks for Multimodal Deepfakes, Gartner Warns
Gartner found 41% of CISOs faced deepfake audio-call attacks and urged updates to incident response playbooks.
At the Gartner Security & Risk Management Summit in London, Gartner published a survey of 297 senior cybersecurity leaders conducted from March to May 2026. Forty-one percent reported at least one deepfake social-engineering incident on an employee audio call in the prior 12 months, and 36% reported one on a video call. Seventy-nine percent reported email phishing, spearphishing, or business email compromise, while 58% reported vishing or smishing. Analyst Craig Porter urged verification-first workflows, phishing-resistant authentication, and incident-response updates for multimodal impersonation and misused AI agents.
- Gartner surveyed 297 cybersecurity leaders from March to May 2026.
- 41% reported a deepfake incident on an employee audio call.
- 36% reported a deepfake incident during a video call.
- 79% saw email phishing, spearphishing, or business email compromise.
- Gartner urges verification-first controls and updated response playbooks.
Full article342 words · extracted from infosecurity-magazine.com · click to collapse
Almost half of CISOs have reported at least one deepfake incident in the past 12 months, highlighting the need to update incident response playbooks to address multimodal deepfake threats.
As the opening of the Gartner Security & Risk Management Summit in London on September 22, the global consulting firm published findings from its AI-driven Social Engineering Attacks report, which surveyed 297 senior cybersecurity leaders.
The study, conducted between survey conducted in March and May 2026, found that AI is increasing the volume, personalization and credibility of social engineering while reducing the reliability of familiar detection cues.
More than four in ten respondents (41%) reported at least one social engineering incident involving a deepfake during an employee audio call in the previous 12 months and 36% reported one during a video call.
Additionally, 79% of CISOs surveyed reported at least one email phishing, spearphishing, or business email compromise (BEC) incident in the last 12 months, while 58% reported one vidoe phishing (vishing) or SMS phishing (smishing) incident.
Craig Porter, director analyst at Gartner, said that as most attacks will continue to rely on users, stolen credentials, weak recovery processes and familiar technical methods, CISOs “must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats.”
How CISOs Can Mitigate Deepfake Phishing Threats
To effectively counter evolving AI social engineering attacks, Porter’s team shared three measures CISOs should take:
- Shift secure behavior and culture programs from teaching employees to “spot the fake” toward making secure verification the standard for consequential requests, with training, simulations, and clear expectations to pause, verify, and report suspicious activity across all communication channels
- Protect high-value workflows such as account recovery, privileged access, and payment authorization with phishing-resistant authentication, risk-based identity controls, trusted verification channels, and measures that detect identity abuse after login or password resets
- Correlate suspicious communications and impersonation reports with account recovery events, new devices, privilege changes, and financial transactions, while updating incident response playbooks to address multimodal impersonation, manipulated AI recommendations, and compromised, misused, or out-of-bounds AI agents
Text extracted automatically; images, tables and formatting may be missing. Original: