Deepfakes Are Breaking Digital Trust: Gartner

Deepfakes are rapidly moving from an emerging threat to a mainstream enterprise security challenge. A Gartner survey found 41% of CISOs experienced at least one deepfake-related social engineering incident during an employee audio call in the previous 12 months, while 36% reported incidents involving video calls.

The survey of 297 senior cybersecurity leaders highlights how generative AI is increasing the scale, personalization and credibility of social engineering attacks, making traditional visual and verbal warning signs increasingly unreliable.

Conventional attacks remain dominant: 79% of CISOs reported phishing, spear-phishing or business email compromise incidents, while 58% experienced vishing or smishing.

The emerging danger is convergence. Attackers can combine phishing, compromised credentials, personal information, synthetic voices and deepfake video across multiple channels to create highly convincing impersonation attacks.

Gartner recommends replacing conventional “spot the fake” awareness programs with adaptive verification practices. Employees handling sensitive requests should pause, independently verify identities and follow established authorization procedures regardless of how convincing a communication appears.

Organizations must also strengthen identity, privileged access, account recovery and payment authorization using phishing-resistant authentication and risk-based controls. Security teams should correlate suspicious communications with new devices, privilege changes, account recovery events and financial transactions.

The message for CISOs is increasingly clear: deepfake defence cannot operate as a standalone security layer.Enterprises need to combine identity security, behavioural monitoring, multimodal deepfake detection and continuous authentication—moving cybersecurity from simply trusting credentials toward continuously establishing whether the person behind them is genuine.