Gartner Survey Finds 41% of CISOs Reported At Least One Social Engineering Incident Involving a Deepfake in the Past 12 Months

• 29 Sep 2026
• TM Team
• 0 Comments

Forty-one percent of chief information security officers (CISOs) reported at least one social engineering incident involving a deepfake during an employee audio call in the previous 12 months, and 36% reported one during a video call, according to a survey by Gartner, Inc., a business and technology insights company.

The survey conducted in March-May 2026 on 297 senior leaders of the cybersecurity function (CISO or equivalent) found that AI is increasing the volume, personalization, and credibility of social engineering while reducing the reliability of familiar detection cues.

“Attackers can combine phishing, business email compromise, synthetic media, and aggregated personal context across multiple channels,” said Craig Porter, Director Analyst at Gartner. “Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods. CISOs must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats.”

Seventy-nine percent of CISOs surveyed reported at least one e-mail phishing, spear-phishing, or business e-mail compromise incident in the last 12 months, while 58% reported one vishing or smishing incident.

To effectively counter evolving AI social engineering attacks, CISOs must focus on three critical actions:

1.    Transform Static Training into Adaptive Security Behavior and Culture Programs

·       Evolve secure behavior and culture programs from teaching employees to “spot the fake,” toward making secure verification the expected behavior for consequential requests. Train employees and approvers to pause, verify, and report high-risk requests regardless of whether the request arrives through e-mail, voice, video, collaboration tools, or an AI application. Use workforce simulations to test verification and reporting behavior of AI-related suspicious events.

2.    Harden Workforce Identity and Recovery Against Impersonation

·        Protect high-value workflows such as account recovery, privileged access, and payment authorization with phishing-resistant authentication, risk-based identity controls, and trusted verification channels. In addition, implement controls to detect identity abuse, including after a successful login or password reset.

3.    Prepare Detection and Response for AI-Mediated Threats