The latest deepfake numbers give CISOs plenty to worry about
Gartner survey of 297 CISOs finds 41% faced deepfake audio-call social engineering incidents and 79% faced phishing or BEC in the past year.
A Gartner survey of 297 senior cybersecurity leaders (March–May 2026) found 41% of CISOs reported at least one deepfake incident during an employee audio call and 36% during a video call in the past 12 months. 79% reported phishing, spear-phishing, or BEC incidents and 58% reported vishing or smishing. Gartner recommends phishing-resistant authentication, verification-by-default for risky requests, and IR playbooks updated for multimodal impersonation and compromised AI agents. The article cites the 2024 Hong Kong deepfake video-call scam that cost a multinational over $25 million and notes North Korean operatives use deepfakes to infiltrate companies as remote IT workers.
- 41% of CISOs reported deepfake audio-call incidents; 36% video-call incidents
- 79% reported phishing, spear-phishing, or BEC in past 12 months
- Gartner urges verification-by-default and phishing-resistant authentication
- Hong Kong 2024 deepfake video call fraud caused over $25 million loss
- North Korean operatives use deepfakes to pose as remote IT workers
Full article458 words · extracted from helpnetsecurity.com · click to collapse
AI is letting cybercriminals reach deeper into organizations than a phishing email ever could.
41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner. 36% reported the same for a video call.
79% of CISOs surveyed reported at least one phishing, spear-phishing, or business email compromise incident in the past 12 months. 58% reported a vishing or smishing incident.
“Attackers can combine phishing, business email compromise, synthetic media, and aggregated personal context across multiple channels,” said Craig Porter, Director Analyst at Gartner.
“Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods. CISOs must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats,” added Porter.
The survey covered 297 senior cybersecurity leaders and ran between March and May 2026.
Gartner recommends three steps for CISOs
Teaching employees to “spot the fake” isn’t enough anymore. Verification needs to become the default response for any request that carries risk, whether it comes through email, a phone call, a video meeting, a collaboration tool, or an AI application.
Account recovery, privileged access, and payment authorization are the workflows attackers go after most, so they need phishing-resistant authentication, risk-based identity controls, and verification channels attackers can’t spoof.
Detecting these attacks means connecting the dots. Suspicious communications and impersonation reports should be checked against account recovery events, new devices, privilege changes, and financial transactions.
“Update incident response playbooks for multimodal impersonation, manipulated AI recommendations, compromised or misused agents, and where applicable, agents that operate beyond their intended boundaries,” the company noted.
AI fraud is becoming harder to detect
The problem is that AI technology keeps getting better, and it’s become harder for people to tell the difference. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to a Malwarebytes.
One of the most cited cases of this happening is a 2024 incident in Hong Kong, where a finance employee at a multinational firm’s Hong Kong branch joined a video call believing it included the company’s CFO and several colleagues. The employee ended up transferring over $25 million, to accounts controlled by the scammers.
A Jumio survey found that 69% of global respondents believe AI-powered fraud now poses a greater threat to personal security than traditional identity theft.
Deepfakes are one of the main tools North Korean operatives use to infiltrate Western companies as remote IT workers.
Catching deepfakes is also part of the problem. Researchers at the Vector Institute say detection, treated as a standalone technical capability, is losing ground and will likely keep losing ground as generative models keep improving.