Three quarters of cybersecurity leaders say their organization has faced a suspected deepfake incident during the last year and a quarter of those hit by one say it cost the business over $1m in total, a new report has warned.
The 2026 Pindrop Deepfake Readiness Index, published on 28 September, warned there is a significant gap between the threat of deepfake attacks and enterprise readiness to defend against them.
Deepfakes are AI generated audio and videos of people. The technology has become increasingly sophisticated, making it difficult for anyone watching or listening to the deepfake to tell that it isn’t footage of a real person.
Cybercriminals have turned to deepfakes as part of hacking and fraud campaigns. They are used to pose as someone like a colleague, their boss or their CEO and trick victims into sharing sensitive information or making a fraudulent financial transfer.
It has even been known for North Korean nation-state hackers to use deepfakes to pose as fake IT workers looking for jobs to get hired by technology and software companies.
Pindrop’s survey of over 250 US security leaders found that 74% said they have encountered a suspected deepfake attack in the last 12 months. Of those, one in four reported losses of over $1m because of a single incident, while nearly half (49%) of those hit by deepfake attacks reported losses of $500,000.
The financial cost of deepfake attacks included direct losses, as well as the costs associated with remediating the incident, as well as the time and resources it took staff to work in response to the attack.
Boardrooms Don’t Fully Understand Deepfake Threat
Despite the cybersecurity risk and financial damage posed by deepfake attacks, security leaders are not confident that boardrooms understand how deepfake attacks represent a major threat to enterprises, which could fall victim to major data or financial theft as result of an incident.
According to the report, three in four respondents said that it would take a company leader being impersonated in – or fooled by – a deepfake attack before the deepfake cybersecurity challenge deepfakes becomes a board level or leadership issue.
Meanwhile, 93% of security leaders expressed concern that their organization is not currently prepared to face the threat posed by deepfake attacks.
“Attackers have figured out that one of the easiest ways around sophisticated security controls is to impersonate the human those controls are designed to trust. Deepfakes turn our most instinctive signals of identity, a familiar face and voice, into an attack surface,” said Elie Khoury, SVP of research at Pindrop.
“Enterprises need to bring the same rigor used to secure systems and devices to the live human interactions where critical decisions are being made,” he added.
A recent report by Gartner warned that CISOs must update their playbooks to take into account the rise of sophisticated deepfakes.
To help counter deepfake attacks, it’s recommended that staff are trained on how to identify them, that phishing resistant controls such as MFA are employed across systems and that security teams should be on the lookout for suspicious communications and impersonation events.