Three quarters of cybersecurity leaders say their organization has faced a suspected deepfake incident during the last year, and a quarter of those hit by one say it cost the business over $1 million in total, a new report has warned. The 2026 Pindrop Deepfake Readiness Index, published on September 28, warned there is a significant gap between the threat of deepfake attacks and enterprise readiness to defend against them. Deepfakes are AI-generated audio and videos of people that have become increasingly sophisticated, making it difficult for anyone watching or listening to tell that it isn't footage of a real person.
Pindrop's survey of over 250 US security leaders found that 74% said they have encountered a suspected deepfake attack in the last 12 months. Of those, one in four reported losses of over $1 million because of a single incident, while nearly half—49%—of those hit by deepfake attacks reported losses of $500,000. The financial cost of deepfake attacks included direct losses, as well as the costs associated with remediating the incident, plus the time and resources it took staff to work in response to the attack.
Despite the cybersecurity risk and financial damage posed by deepfake attacks, security leaders are not confident that boardrooms understand how deepfake attacks represent a major threat to enterprises. According to the report, three in four respondents said that it would take a company leader being impersonated in—or fooled by—a deepfake attack before the deepfake cybersecurity challenge becomes a board level or leadership issue. Meanwhile, 93% of security leaders expressed concern that their organization is not currently prepared to face the threat posed by deepfake attacks. "Attackers have figured out that one of the easiest ways around sophisticated security controls is to impersonate the human those controls are designed to trust," said Elie Khoury, SVP of research at Pindrop.
Cybercriminals have turned to deepfakes as part of hacking and fraud campaigns, using them to pose as someone like a colleague, their boss, or their CEO and trick victims into sharing sensitive information or making a fraudulent financial transfer. It has even been known for North Korean nation-state hackers to use deepfakes to pose as fake IT workers looking for jobs to get hired by technology and software companies. The report notes that deepfakes turn our most instinctive signals of identity—a familiar face and voice—into an attack surface, and enterprises need to bring the same rigor used to secure systems and devices to the live human interactions where critical decisions are being made.
To help counter deepfake attacks, it's recommended that staff are trained on how to identify them, that phishing-resistant controls such as multi-factor authentication are employed across systems, and that security teams should be on the lookout for suspicious communications and impersonation events. A recent report by Gartner warned that CISOs must update their playbooks to take into account the rise of sophisticated deepfakes. Organizations that wait for a board member to experience a deepfake incident firsthand may find themselves racing to catch up on defenses that should already be in place. The disconnect between executive understanding and frontline security concerns suggests that closing the readiness gap will require not just better technology but a fundamental shift in how leadership perceives the human element of cyber risk.