Summary
- Forty-one per cent of Gartner respondents reported at least one deepfake social-engineering incident involving an employee audio call, while 36% reported one involving video.
- The survey covered 297 CISOs or equivalent senior cybersecurity leaders between March and May 2026.
- Conventional phishing and business email compromise remained more widely reported, indicating synthetic media is becoming another layer within established impersonation techniques.
Deepfake-enabled social engineering is appearing inside ordinary enterprise voice and video communications, with a Gartner survey finding that 41% of senior cybersecurity leaders had encountered at least one such incident involving an employee audio call during the previous 12 months.
Thirty-six per cent of respondents reported at least one social-engineering incident involving a deepfake during a video call. Gartner conducted the survey between March and May 2026 among 297 CISOs or equivalent senior leaders of cybersecurity functions.
The figures are based on respondents’ reports rather than independently verified incident records, so they do not establish the proportion of all enterprises experiencing deepfake attacks. They nevertheless indicate that synthetic voice and video have entered communications channels already used for fraud and identity attacks.
Established techniques remained more widely reported. Seventy-nine per cent of respondents said their organisation had experienced at least one email phishing, spear-phishing, or business email compromise incident during the same 12-month period, while 58% reported a vishing or smishing incident.
Deepfakes therefore appear to be adding credibility to existing social-engineering methods rather than replacing them. Synthetic voice or video can be combined with stolen credentials, compromised mailboxes, public information, and knowledge of internal processes to make an impersonation attempt harder to assess.
The operational exposure becomes more serious where a communication can trigger a consequential action. Payment approval, changes to supplier banking information, account recovery, privileged-access requests, disclosure of confidential data, and executive instructions can all rely partly on an employee believing they recognise the person making the request.
Voice and video have often been treated as a useful second channel after a suspicious email. Synthetic media weakens that assumption if an attacker can impersonate the same individual convincingly across more than one communication method.
That shifts part of the security model from recognising whether a person looks or sounds genuine towards proving whether the request itself is authorised. A process based on independent approval and strong identity controls is less dependent on a person detecting visual or audio manipulation in real time.
The same shift applies to account recovery. A familiar voice or face can no longer be treated as a strong identity factor where sufficiently convincing synthetic media is available. Recovery and privilege workflows instead need to rely on controls that are difficult to reproduce merely by knowing what an individual sounds or looks like.
Personalisation also changes the economics of social engineering. Public profiles, corporate websites, social media, compromised mailboxes, and previously stolen data can provide enough contextual material to make an impersonation attempt specific to the target organisation rather than generic.
Incident response becomes more complicated as well. A fraudulent video call may be only one visible element of a wider identity compromise involving a newly enrolled device, changed recovery information, compromised email, or suspicious financial activity.
Gartner’s findings do not show deepfakes overtaking conventional phishing; the survey figures indicate the opposite. Email-based social engineering remains more widely reported. The change is that voice and video are becoming less reliable as independent proof of identity.
As synthetic media moves into established fraud workflows, enterprise controls increasingly have to prove who or what is authorised to perform an action rather than depending on whether a communication appears human and familiar.
