When a Voice or Face Is Fake, Security Has to Verify Twice
A Gartner survey signal suggests deepfake-driven impersonation is now a practical social engineering risk for security leaders, especially when trust is granted too quickly over audio or video.
Introduction
A familiar voice can lower defenses in seconds. So can a convincing face on a video call. That is the uncomfortable lesson behind a recent Gartner survey signal: deepfakes are not just a novelty of synthetic media, but a growing test of how organizations confirm identity when pressure is high and time is short.
Fast Facts
- 41% of CISOs surveyed reported at least one deepfake-related social engineering incident in audio calls over the past 12 months.
- 36% reported at least one similar incident in video calls during the same period.
- The survey window was between March and May 2026.
- The findings point to impersonation risk in channels many teams still treat as trusted.
Body
The hard fact pattern is narrow, but the security meaning is broad. Deepfakes may be effective in social engineering because they can exploit human verification gaps: people often trust voice, appearance, and urgency before they verify the request through a second channel.
That is why the result matters for security operations, not just awareness training. If a call sounds plausible, or a video looks convincing, defenders cannot assume authenticity. The risk is not only that someone is fooled, but that the organization treats a synthetic identity as good enough to authorize action.
From a defensive perspective, the lesson is to make verification procedural rather than intuitive. A second channel, a callback to a known number, or an out-of-band approval step is more reliable than relying on recognition alone. The point is not to eliminate trust, but to make trust harder to forge.
These findings do not identify specific victims, organizations, or case details, and they do not establish how each incident unfolded. The available information supports a focused risk reading, not a claim that every environment faced the same exposure or that any particular control failed.
Netcrook’s read is straightforward: synthetic media is pushing social engineering from a nuisance into a credibility attack. The organizations most at risk are the ones that still allow identity to be proved by a single voice, a single face, or a single urgent request.
Conclusion
The deeper lesson is not that deepfakes always win. It is that they only need to work long enough to start a chain of trust. In an era where audio and video can be manufactured, security teams should treat verification as a required control, not an optional courtesy.
TECHCROOK
Hardware security key: A small physical device used for multi-factor authentication and stronger account verification. It adds a separate trust step beyond passwords and can support more resilient login and approval workflows for teams that handle sensitive access.
WIKICROOK
- Deepfake: Synthetic audio or video designed to imitate a real person.
- Social engineering: Manipulating people into revealing information or taking action.
- CISO: Chief Information Security Officer, the executive responsible for security strategy.
- Out-of-band verification: A check performed through a separate, trusted channel.
- Identity assurance: The confidence that a person or system is truly who it claims to be.
