Deepfake technology is increasingly being used in cyber fraud, affecting payment processes, help desk operations, and access requests. Conducting structured drills can help security teams identify weaknesses in their verification processes before any real damage occurs.
Understanding the Threat of Deepfake Attacks
In a typical scenario, an employee receives a call from someone who sounds like a senior executive, requesting an urgent payment. Such incidents, which were once hypothetical, are now being reported more frequently. A 2025 Gartner survey revealed that 62% of cybersecurity leaders experienced a deepfake attack in the previous year. Additionally, 43% faced deepfake audio incidents, and 37% encountered challenges with video deepfakes.
These fraudulent requests are not limited to financial transactions. Cloned voices can manipulate help desks to move MFA tokens or convince identity admins to create unauthorized accounts. While most organizations have verification policies, many have not tested their effectiveness against deepfake scenarios. Setting up readiness drills can expose vulnerabilities and improve response strategies.
Implementing Effective Verification Processes
Traditional security training focuses on recognizing anomalies in communications, such as awkward language or mismatched email addresses. However, deepfakes present fewer detectable cues. The FBI has warned about AI-generated voice messages mimicking officials, advising verification through independently sourced contacts.
An Osterman Research study highlighted that 60% of security leaders are not confident in countering deepfake attacks with current training. Therefore, defenses need to rely more on robust verification processes than on perceptual skills alone. Consistent verification steps for financial and access requests can mitigate the risk, regardless of the deepfake’s quality.
Conducting Deepfake Readiness Drills
To begin, identify key individuals whose voices might be cloned, such as executives involved in finance and operations. Simultaneously, pinpoint employees who might receive such calls, including those in finance and IT.
Next, establish clear verification protocols. Effective rules include out-of-band callbacks, dual approval systems, and challenge phrases. Encourage a no-blame culture for reporting suspicious requests to foster prompt action.
Design multi-channel scenarios that mirror real-world attacks, starting with emails or chats followed by voice or video calls. Secure necessary approvals for using synthetic or actor-generated voices in drills to avoid privacy issues.
Evaluating and Improving Security Measures
Conduct tabletop exercises to identify policy gaps before moving to live simulations. Monitor key metrics such as verification rates and time to escalation to understand where processes fail.
After each drill, hold prompt debrief sessions to review what was effective and what needs improvement. Update protocols and repeat drills regularly, especially when organizational changes occur.
While process improvements carry the bulk of defense, technology can assist in detecting setup messages and verifying identities during calls. Behavioral email security and real-time identity verification tools can preemptively disrupt deepfake attempts.
Starting small with basic drills can provide valuable insights into your organization’s readiness against deepfake threats. Implementing these practices can significantly strengthen your defenses.
