A Gartner survey has put a precise figure on a growing security concern: 41% of surveyed chief information security officers said their organisation had experienced at least one social-engineering incident involving a deepfake during an employee audio call in the previous 12 months. The finding is significant, but it is narrower than many headlines suggest. It describes reported incidents among 297 senior cybersecurity leaders, not 41% of all companies, calls or employees. [1]
Key points
- Gartner’s 41% figure covers at least one reported deepfake-linked social-engineering incident during an employee audio call.
- The survey covered 297 CISO-level leaders and ran from March to May 2026.
- Gartner separately reported 36% for incidents during video calls; the two figures should not be combined.
- A familiar voice is not proof of identity, especially when a request involves money, credentials or account recovery.
What happened
Gartner published the survey finding on September 22, 2026. It said 41% of the CISO or equivalent respondents had reported at least one social-engineering incident involving a deepfake in an employee audio call over the preceding 12 months. The same release put the video-call figure at 36%. Gartner also reported that 79% had experienced at least one email phishing, spear-phishing or business-email-compromise incident, while 58% had experienced vishing or smishing. [1]
The survey was conducted between March and May 2026 and included 297 senior cybersecurity leaders. That denominator is essential. The result is a survey measure of leaders’ reports, not an independently audited count of attacks. Gartner’s public release does not provide a full questionnaire, country-by-country breakdown or margin of error. It also does not say that every reported event led to a successful transfer, account takeover or data loss.
Help Net Security independently reported the same Gartner findings, including the audio-call and video-call percentages, sample size and field period. Its account is useful confirmation of what Gartner released, but it is not a second survey or a separate incident database. [2]
Why it matters
Voice cloning attacks exploit a normal workplace shortcut: people often trust a familiar voice, a known executive’s name or an urgent request. The Federal Trade Commission has warned that scammers use cloned voices to make requests for money or information more believable, including calls that impersonate a boss or a family member. [3]
For businesses, the danger is not limited to a fake voice in isolation. An attacker can combine a convincing call with an email, text message, collaboration request or stolen account details. Gartner’s Craig Porter said attackers can combine phishing, business email compromise, synthetic media and personal context across several channels. The security problem is therefore an identity and process problem, not simply a question of whether an employee can hear an artificial sound. [1]
How a deepfake call can pressure a team
A typical high-risk request has several warning features: urgency, secrecy, a change in payment details, a request for a one-time code, or a demand to move the conversation to a new platform. The voice may sound correct while the surrounding request is abnormal. A short pause or imperfect pronunciation can be a clue, but the absence of an obvious flaw is not authentication.
The FBI’s Internet Crime Complaint Center described a 2025 campaign in which actors used AI-generated voice messages and texts while impersonating senior US officials. The messages sought to establish rapport and could lead targets toward another messaging platform, account access or requests for information and funds. The FBI advised recipients to locate a trusted number independently and verify the contact before responding. [5]
That advice applies to companies as well as individuals. A caller asking for a payment, privileged-access change or recovery action should not be verified by calling the same number back or by asking for a second message on the same channel. Verification should use a pre-established contact route and, for consequential actions, a second approver who was not part of the original exchange.
What organisations can do now
Gartner’s recommendations focus on changing behaviour rather than training people to win a visual or audio guessing game. Security programmes should make “pause, verify and report” the expected response to high-risk requests, whether they arrive by email, voice, video, a collaboration tool or an AI application. Simulations can test whether staff follow that process under pressure. [1]
Account recovery, privileged access and payment authorisation deserve extra controls. Phishing-resistant authentication, risk-based identity checks and trusted verification channels can reduce the chance that a convincing impersonation becomes a sensitive action. Recovery procedures should be reviewed separately because an attacker who cannot pass a normal login may instead try to persuade staff to reset an account.
Detection also needs context. Gartner recommends correlating suspicious communications and impersonation reports with account-recovery events, new devices, privilege changes and financial transactions. That approach does not require an organisation to identify every synthetic clip perfectly. It looks for a pattern of unusual activity around a request and creates a route for escalation.
What remains uncertain
The Gartner percentage does not reveal how respondents defined “deepfake,” whether incidents were confirmed by technical analysis, or how many involved audio generated in real time rather than a prepared recording. It also does not establish where the incidents occurred or whether the rate is representative of all organisations. Those unknowns limit comparisons with other surveys.
The government guidance is similarly contextual, not a measurement of prevalence. CISA, the NSA and the FBI described synthetic media as a growing challenge for modern communications and critical-infrastructure organisations in a 2023 information sheet, but that archived alert does not validate the 2026 Gartner percentage. [4] The FTC’s discussion of detection and authentication approaches shows that tools are being explored; it does not make a detector a complete answer. [3]
Readers should therefore avoid two opposite mistakes: dismissing the finding because it comes from a survey, or treating it as proof that 41% of calls are fake. The defensible conclusion is that senior security leaders are reporting exposure to deepfake-enabled social engineering, while the size and distribution of the underlying problem still need more transparent, comparable measurement.
What happens next
The immediate operational step is to review workflows where a voice or video request can trigger money movement, access changes, data release or account recovery. Organisations should document an independent callback route, require a second person for high-risk approvals and make it easy to report suspicious interactions without penalising the employee who pauses the request.
Security teams should also recheck playbooks as attackers combine channels. A deepfake call may be only the opening move, followed by a malicious link, a request for a one-time code or an attempt to reset an account. The FBI advises not sharing sensitive information or authentication codes with an unverified contact and recommends multifactor authentication. [5]
Gartner’s survey is a reason to strengthen verification discipline, not a reason to rely on a single detection score. The most durable control is a process that remains safe when the voice sounds familiar and the request feels urgent. Future research will be more useful when it publishes clearer definitions, sample composition and evidence distinguishing attempted impersonation from confirmed loss.
