The latest deepfake numbers give CISOs plenty to worry about
AI is letting cybercriminals reach deeper into organizations than a phishing email ever could.
41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner. 36% reported the same for a video call.
79% of CISOs surveyed reported at least one phishing, spear-phishing, or business email compromise incident in the past 12 months. 58% reported a vishing or smishing incident.
“Attackers can combine phishing, business email compromise, synthetic media, and aggregated personal context across multiple channels,” said Craig Porter, Director Analyst at Gartner.
“Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods. CISOs must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats,” added Porter.
The survey covered 297 senior cybersecurity leaders and ran between March and May 2026.
Gartner recommends three steps for CISOs
Teaching employees to “spot the fake” isn’t enough anymore. Verification needs to become the default response for any request that carries risk, whether it comes through email, a phone call, a video meeting, a collaboration tool, or an AI application.
Account recovery, privileged access, and payment authorization are the workflows attackers go after most, so they need phishing-resistant authentication, risk-based identity controls, and verification channels attackers can’t spoof.
Detecting these attacks means connecting the dots. Suspicious communications and impersonation reports should be checked against account recovery events, new devices, privilege changes, and financial transactions.
“Update incident response playbooks for multimodal impersonation, manipulated AI recommendations, compromised or misused agents, and where applicable, agents that operate beyond their intended boundaries,” the company noted.
AI fraud is becoming harder to detect
The problem is that AI technology keeps getting better, and it’s become harder for people to tell the difference. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to a Malwarebytes.
One of the most cited cases of this happening is a 2024 incident in Hong Kong, where a finance employee at a multinational firm’s Hong Kong branch joined a video call believing it included the company’s CFO and several colleagues. The employee ended up transferring over $25 million, to accounts controlled by the scammers.
A Jumio survey found that 69% of global respondents believe AI-powered fraud now poses a greater threat to personal security than traditional identity theft.
Deepfakes are one of the main tools North Korean operatives use to infiltrate Western companies as remote IT workers.
Catching deepfakes is also part of the problem. Researchers at the Vector Institute say detection, treated as a standalone technical capability, is losing ground and will likely keep losing ground as generative models keep improving.
