CISOs Urged to Update Response Playbooks as Deepfake Attacks Rise

Chief Information Security Officers (CISOs) must urgently revise their incident response playbooks to account for the increasing sophistication of multimodal deepfakes, according to a new report from Gartner.

The findings, released during the Gartner Security & Risk Management Summit in London, reveal that AI-powered social engineering is becoming significantly more difficult to detect. The research, based on a survey of 297 senior cybersecurity leaders conducted between March and May 2026, highlights a sharp rise in impersonation attempts using synthetic media.

The study found that 41% of respondents reported at least one social engineering incident involving a deepfake during an employee audio call within the previous 12 months. Furthermore, 36% of CISOs reported similar incidents occurring during video calls.

Escalating Social Engineering Risks

While deepfakes represent a growing technical challenge, traditional social engineering remains a primary threat vector. The survey noted that 79% of CISOs reported email-based incidents, such as phishing, spearphishing, or business email compromise (BEC), in the last year. Additionally, 58% reported vishing (voice phishing) or smishing (SMS phishing) attempts.

Craig Porter, a director analyst at Gartner, advised that because many attacks continue to exploit stolen credentials and weak recovery processes, security leaders must apply the same rigour used for identity and access risk assessment to combat AI-driven threats.

Mitigation Strategies for CISOs

To counter these evolving threats, Gartner recommends three primary defensive shifts:

• Prioritise Verification over Detection: Security culture programmes should move away from simply teaching employees to “spot the fake.” Instead, organisations should establish secure verification as the standard requirement for any consequential request.
• Protect High-Value Workflows: Critical processes—including account recovery, privileged access management, and payment authorisations—must be shielded with phishing-resistant authentication and risk-based identity controls.
• Correlate Signals: Security teams should link reports of suspicious communications with technical indicators such as account recovery events, the introduction of new devices, privilege changes, and financial transactions.

Gartner also emphasised the need for updated incident response playbooks that specifically address multimodal impersonation, manipulated AI-generated recommendations, and the potential misuse of autonomous AI agents.