The Threat Moved to Voice and Video

Gartner's May 2026 research on deepfake identity impersonation put hard numbers on a shift practitioners have felt for a year: synthetic media has moved off the novelty shelf and into live calls. In a survey of cybersecurity leaders, 41% reported a deepfake combined with social engineering on an audio call, and 35% on a video call. A separate Gartner survey put roughly 62% of organizations at one or more deepfake incidents in a single year.

Read the channel split again, because it sets up the whole problem. The attacks are landing on voice and video — the two surfaces almost no security program rehearses. Most teams still measure readiness by who clicks a phishing email. That metric was built for a threat attackers moved past a year ago, and Gartner data suggests only about 10% of security leaders currently prioritize deepfake recognition in their awareness programs at all.

That gap — between where the attacks land and where the training points — is the entire story. And the fix is not the one most teams reach for first.

Policy, Procedure, Process: Brutally Effective. Awareness Training Never Tests It.

Here's the part that gets lost in the alarm: Gartner doesn't just diagnose the threat, it prescribes the fix — and the fix is process. Gartner's remediation guidance is explicit that approval flows should assume a convincing face or voice can be faked, and that second-channel verification should gate any payment triggered by voice or video. Callback protocols, dual authorization, out-of-band confirmation. Written into policy, drilled into procedure, and actually executed, it works almost every time. The attack dies the instant someone hangs up and dials a known number to confirm. No model, no vendor, no detection arms race required.

And Gartner is just as explicit about the training side: it tells security leaders to drill teams on realistic social-engineering scenarios, not synthetic-media theory. That distinction is the whole game. A training module teaches the policy — a slide says "verify on a second channel," people nod, pass the quiz, and move on. That proves they can recognize the right answer in a classroom. It proves nothing about what they do when a deepfaked CFO is on the line, demanding the wire clears before market close, and pushing back the moment they hesitate.

Knowledge is not behavior. Comprehension is not muscle memory. You can have the policy written, the procedure documented, and the training completed — and still have no idea whether any of it holds when the attack arrives. The only honest test of a process is to run the attack against it — which is precisely the realistic-scenario testing Gartner points security leaders toward, and precisely what slideware can't deliver.

Why Detection Won't Close the Gap

The reflex, faced with a synthetic-media threat, is to buy a synthetic-media detector. Gartner's own guidance is blunt about why that fails as a primary control: deepfake detection is probabilistic, its benchmarks are immature, and the generation tools improve faster than the point products chasing them.

The telemetry backs that up. iProov's 2026 Threat Intelligence Report recorded a 1,151% increase in attacks injecting synthetic media directly into identity systems on iOS in the second half of 2025 alone. The cost of producing a convincing fake is collapsing while the quality climbs. Any defense premised on reliably spotting the fake is racing a curve it cannot win.

Detection has a place as one layer. But the control you stake an authorization decision on cannot be "we'll notice it's fake." It has to be a process that doesn't care whether the face and voice are real — because it verifies through a channel the attacker doesn't control.

The Four Shifts That Should Change Your 2026 Plan

Pull the research together and four shifts rise above the rest. Each one tells security leaders something different about where to put time, budget, and program attention before the next breach cycle hits.

Same Attack, Two Eras — One Defense

The mechanics of the attack haven't fundamentally changed. What changed is how convincingly it can be delivered. Look at the two versions side by side and the important thing becomes obvious: the defense is identical in both columns.

The defense does not change between columns. Process resilience doesn't care which era the attack arrived from. A help desk that requires out-of-band verification before resetting credentials stops the scripted caller and stops the deepfaked one. The synthetic media raises the believability; it does nothing to the control.

From the Field: What Happens When We Actually Test the Process

The action rate is the number that should reframe how leaders think about their programs. A click is the opening move; the breach is the completed action — a credential surrendered, a payment approved, a remote session opened. At an 11.7% median action rate, roughly one in nine targeted users went all the way through a synthetic-media-driven scenario. And 78% of tested organizations rated highly vulnerable, with only 8% showing no meaningful susceptibility.

Here is the part that matters most against Gartner's data. Many of these organizations already had verification policies on the books and had run conventional awareness training. It didn't move their results in any meaningful way. The policy existed on paper. It had simply never been tested under a realistic attack — so when one arrived, the process folded exactly where the policy said it shouldn't.

What This Means for Your Program

Read together, Gartner's 2026 findings and the field data form one coherent argument: the control that works is already known and brutally effective, the attacks have moved to channels the control is rarely tested on, and the gap between a written policy and a proven one is where the breach happens.

The concrete moves map directly onto Gartner's own recommendations. Simulate across voice and video, with scenarios tailored to the roles attackers actually target — help desk, finance, executive assistants, anyone with reset authority or wire approval. Make second-channel verification a control you test, not a policy you publish — run the deepfaked executive at your AP team and watch whether the callback actually happens. And measure the process outcome, not the click: whether the wire was held, the reset refused, the session denied. Gartner names the controls and the training approach; this is what executing them looks like.

None of this requires winning a detection arms race. It requires proving that the cheap, durable control you already believe in survives contact with a convincing fake — before a real adversary runs that test for you.

The Bottom Line

Gartner's 2026 data is the clearest signal yet that deepfake social engineering has moved into live voice and video — 41% on audio calls, 35% on video — while detection remains probabilistic and most programs still point at email. The defense isn't a mystery. Second-channel verification is brutally effective and always has been.

The failure isn't the control. Gartner prescribed it — second-channel verification — and prescribed the training approach to match: realistic scenarios, not theory. The breakdown is that organizations publish the policy and never test it. Our field data makes the cost of that gap concrete: workforces with verification policies on the books still folded, 78% rated highly vulnerable, and nearly one in nine targeted users completed a full compromise. A policy you haven't tested under fire isn't a control. It's a hope.

Frequently Asked Questions

Direct answers to the questions security leaders, CISOs, and risk owners ask most often about Gartner's 2026 deepfake research and how to translate it into program decisions.