A few weeks ago, IBM released its 2026 Cost of a Data Breach Report. The study found that 25% of malicious attacks were AI-driven, a 56% increase from last year. Of those, 45% were an AI deepfake or impersonation attack.
Impersonation attacks are a type of social engineering where bad actors generate video, audio, images, and/or messages that appear to come from a trusted source. That source could be a top executive, a vendor, a job applicant, or a similar known party.
While not a new concept, deepfakes have been considered a fringe threat unlikely to affect small and mid-sized businesses. IBM’s report suggests it’s time we paid closer attention.
Why are we seeing an increase in deepfakes?
The technology behind deepfakes (a Generative Adversarial Network) was developed in 2014, and open-source deepfake tools followed a few years later in 2018.
Still, AI deepfake attacks remained less prevalent than AI-generated phishing scams as recently as last year. We attribute the spike to two main factors: accessibility and novelty.
Accessibility: AI makes impersonation easy.
AI phishing has shown us how an organization’s digital footprint can be weaponized. With little effort, AI tools can extract enough data on the company, its work, its partners, and its employees to architect an extremely convincing email scam.
Generative AI has now evolved to the point where limited input can create realistic multimedia output:
- 3 seconds of clean audio can produce a convincing voice clone.
- 15 seconds of video footage can produce a photorealistic avatar.
- 2 minutes of video footage can produce a digital twin that mimics physical gestures.
In other words, a single video posted to your company’s LinkedIn page is enough source material for a deepfake campaign.
Novelty: Deepfakes exploit “safe” behavior.
For years, IT teams like ours have emphasized the importance of verifying an unexpected link, attachment, or request before taking action. If a vendor emails with a change to their ACH information, for example, policy might require a phone call to confirm legitimacy.
Now imagine the vendor emails, but then proactively calls and insists on an immediate change to avoid service disruption. Or instead of a phone call, the vendor initiates a video conference and requests the change in real time.
Would your policy account for either situation? Would your employee even know it’s possible to fake these methods of communication? These tactics are new enough that the answer to both might be “no.”
How to minimize the risk of impersonation attacks
At their core, deepfake attacks are social engineering scams that get personal. To mitigate this growing threat, your best course of action is to review and recalibrate your existing security controls:
- Harden your email controls to protect against phishing and malicious links.
- Review internal policies to make sure they would withstand impersonation.
- Update your security awareness training to include deepfakes.
- Implement an application whitelisting program to prevent unauthorized installs.
Don’t hesitate to reach out if we can be of service!