Topic starter
25/10/2026 11:10 am
TL;DR: 99.9% of people could not tell an AI voice clone from a real one, which Doppel says in survey evidence shows familiar trust cues are too weak for security decisions. Verification has to move into repeatable approval steps before sensitive action.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Some Assembly Required: Verifying What's Real in 2026”.
By the numbers:
- 99.9% of people can't reliably distinguish an AI-generated voice clone from a real one.
- Across 100 AI voice-clone calls impersonating a CISO, every single employee believed it was real for an average of 6 minutes.
- 62% of organisations have already been targeted by a deepfake attack.
Key questions
Q: Why do awareness programmes fail against deepfake and synthetic phishing attacks?
A: They fail when they rely on recognition rather than verification.
Q: What are the signs that social engineering controls are not keeping up with AI impersonation?
A: Repeated urgent requests, cross-channel inconsistencies, help desk overrides and approval decisions made without secondary verification are all warning signs.
Q: How should security teams handle human verification when voice and video can be faked?
A: Treat voice and video as untrusted indicators, not proof.
Practitioner guidance
- Define high-risk request categories Classify resets, wire approvals, executive requests, vendor bank-detail changes and token resets as actions that require verification beyond the initial message.
- Add out-of-band confirmation steps Require a second channel or callback using independently sourced contact details before any privileged or financial action is completed.
- Harden help desk and service workflows Make support staff verify identity through policy-driven steps before account recovery, MFA changes or delegated access changes are approved.
Bottom line: AI-generated voice, video and text have made traditional trust cues too weak to serve as a reliable security boundary.
Glossary terms: Synthetic trust, Social Engineering Defense, Out-Of-Band Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Trust signals are no longer a reliable security boundary: the weak point is not that people are careless, but that the cues they were trained to use have been industrialised by generative AI. Grammar, tone, caller ID and facial realism can now be manufactured cheaply and at scale, which means awareness training alone cannot carry identity verification. Practitioners should treat every high-risk request as untrusted until corroborated by a separate control.
A question worth separating out:
Q: How should organisations balance human risk training with process controls for impersonation?
A: Training should support process, not replace it. Use awareness content to help people recognise suspicious patterns, but make the actual control a repeatable verification workflow for resets, approvals and sensitive communications. That approach reduces dependence on memory, fatigue and split-second judgment, which are exactly what attackers exploit.
👉 Read our full editorial: AI-fueled impersonation is breaking human trust signals
This post was modified 7 days ago by NHI Mgmt Group