Gartner Survey Finds Deepfake Social Engineering Reported Across Audio and Video Calls
Summary
In a Gartner survey of 297 cybersecurity leaders, 41% reported deepfake social engineering during audio calls and 36% during video calls. Gartner recommends default verification for risky requests, stronger identity controls, and cross-channel monitoring.
Key points
- Gartner surveyed 297 senior cybersecurity leaders between March and May 2026.
- 41% reported at least one deepfake-based social engineering incident during an employee audio call in the previous 12 months; 36% reported one during a video call.
- 79% reported phishing, spear-phishing, or business email compromise, while 58% reported vishing or smishing in the previous 12 months.
- Gartner recommends making verification the default for risky requests across communication channels.
- It advises strengthening account recovery, privileged access, and payment authorization with phishing-resistant authentication, risk-based identity controls, and independent verification channels.
- Gartner recommends correlating suspicious communications and impersonation reports with account recovery events, new devices, privilege changes, and financial transactions.
- The article says researchers at the Vector Institute believe standalone deepfake detection is losing ground as generative models improve.
Article Details
- Publisher
- Gartner
- Report Period
- March-May 2026
- Scope
- Survey of senior cybersecurity leaders on social engineering and deepfake incidents
- Sample Size
- 297 senior cybersecurity leaders
- Key Statistics
- 41% of surveyed CISOs reported at least one deepfake-based social engineering incident during an employee audio call in the past 12 months.
- 36% reported at least one deepfake incident during a video call in the past 12 months.
- 79% reported at least one phishing, spear-phishing, or business email compromise incident in the past 12 months.
- 58% reported at least one vishing or smishing incident in the past 12 months.
- Recommendations
- Make verification the default for risky requests across communication channels.
- Protect account recovery, privileged access, and payment authorization with phishing-resistant authentication, risk-based identity controls, and verification channels attackers cannot spoof.
- Correlate suspicious communications and impersonation reports with account recovery events, new devices, privilege changes, and financial transactions.
- Update incident response playbooks for multimodal impersonation, manipulated AI recommendations, and compromised or misused agents.