Deepfakes attacks on the rise: What partners need to know

AI is fuelling the speed, scale and sophistication of deepfakes.

AI is enabling attackers to combine deepfake attacks such as voice cloning with email phishing and personal information at scale and it’s on the rise.

In a 2026 survey, Gartner reported that 41 percent of CISOs reported at least one social engineering Incident Involving a deepfake in the past 12 months.

Dr Jessica Barker and ethical hacker Freaky Clown (FC), co-founders and co-CEOs of Cygenta, said voice cloning rather than deepfake video is more commonly used by attackers.

“It can take 12 seconds, and even less like five seconds, of audio to clone someone’s voice very convincingly,” said Barker, speaking from this year’s ISC2 Security Congress in Denver.

Cloned voices can then be used in phone scams, such as fake emergencies involving a loved one, which is widespread. By contrast, deepfake video is typically used by attackers for specific, high-value targets than as a routine attack method, Barker noted.

AI has enabled attackers to combine email phishing with voice calls and/or text messages — with more damaging results.

The 2026 Verizon Data Breach Investigations Report (DBIR) found that interactive, conversational attacks on mobile are on the rise, and combining fake text messages with voice calls had a success rate 40 percent higher than traditional email phishing.

The challenge for security service providers is that attackers can utilise AI to conduct open-source intelligence (OSINT), researching employees, scraping LinkedIn profiles, identifying targets and creating convincing, personalised attacks.

“Attackers can do some good OSINT on 50 people in an organisation, send a very convincing phishing email to lower levels and then escalate their move. They don't need to go for that main target straight away,” said FC.

“AI is adding that speed, scale, and in some areas sophistication,” he added.

While deepfake protection as a service may not be in a security partner’s toolkit just now, partners can help customers understand AI is being used in attacks and to incorporate the message into security education and risk discussion.

At their core, deepfake attacks exploit trust, emotional reactions and the way people process information, Barker explained.

Technology may help develop more sophisticated detection tools, training should help employees recognise manipulation, pause before responding to urgent requests and verify suspicious communications through another channel.

“If we can help people understand that [social engineering] is the core strategy, whatever technology gets wrapped around it, whatever new tricks they come up with, the core stays the same,” she said.

Partners can also reinforce the message to organisations that a security culture needs to support employees to feel comfortable questioning suspicious requests, delaying responses when necessary and reporting mistakes without fear of blame.

“Those are cultural questions, and the cybersecurity team can do a lot with that. But it's also about the wider organisational culture,” Barker ended.

Rosalyn Page travelled to Security Congress as a guest of ISC2.