Notifications
Clear all
Topic starter
24/06/2026 9:04 pm
TL;DR: AI voice cloning attacks can be built from 15 to 20 seconds of audio and are becoming easier to execute as AI tools spread, according to 1Kosmos. The control problem is not just deception, but the collapse of verification methods that still trust voice, face, or urgency as proof of identity.
NHIMG editorial — based on content published by 1Kosmos: AI voice cloning and deepfake identity risk
By the numbers:
- AI voice cloning attacks can be built from 15 to 20 seconds of audio.
- The average cost of a data breach has reached $10.22 million for US companies.
- 75% of consumers would stop shopping with a brand that suffered a security incident.
Questions worth separating out
Q: How should organisations verify identity when voice can be cloned with AI?
A: Organisations should treat voice as a low-assurance signal and require a second proof path for any request that can change access, money movement, or account state.
Q: Why do deepfake attacks create a different identity risk than ordinary phishing?
A: Deepfakes reduce the value of human judgment because the attacker can imitate a familiar person, tone, and emotional state in real time.
Q: What breaks when help desk staff trust a convincing voice request?
A: What breaks is the boundary between conversation and authorisation.
Practitioner guidance
- Remove voice as a sole approval signal Require a second, independent verification step for password resets, payment changes, and executive requests.
- Add liveness checks to high-risk identity events Use live facial verification, document validation, or equivalent proof before granting access where identity spoofing would create material impact.
- Redesign help desk approvals as access governance Treat support agents as participants in the identity control plane and bind their actions to policy, logging, and dual approval for sensitive changes.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- The article explains the face and voice verification signals the vendor uses to distinguish live interaction from AI-generated content.
- It outlines how risk thresholds can alter access decisions before a request is approved.
- It describes the combination of facial scanning, document checks, voice analysis, and fraud signals in more operational detail.
- It expands on the practical use of liveness-based authentication for sensitive identity events.
👉 Read 1Kosmos's analysis of AI voice cloning and deepfake identity risk →
AI voice cloning and identity verification gaps: are controls keeping up?
Explore further
25/06/2026 6:04 am
Voice is not an identity proof, it is a weak behavioural signal. This article shows how quickly synthetic audio turns a human-recognition habit into an attack path. The core failure is organisational, not technical: teams still overvalue familiarity, emotion, and urgency when deciding whether to trust a request. Practitioners should treat voice as one input into identity assurance, never as a standalone credential.
A few things that frame the scale:
- The average cost of a data breach has reached $10.22 million for US companies, according to IBM's 2025 Cost of a Data Breach Report.
- Consumer trust loss compounds the breach bill, because 75% of consumers would stop shopping with a brand that suffered a security incident, according to 1Kosmos research.
A question worth separating out:
Q: Who is accountable when AI impersonation causes an unauthorised reset or payment change?
A: Accountability should sit with the organisation that allowed a high-risk change to proceed on weak evidence. Security, IAM, and service owners must define which requests require secondary verification, who can approve them, and what evidence is retained. The control failure is governance, not just user error.
👉 Read our full editorial: AI voice cloning is exposing identity verification gaps in help desks
