Deepfakes are overwhelming businesses unprepared to deal with AI threat: Pindrop

It is generally not considered a good idea to put an apex predator in a room with a five-year-old. Tigers and polar bears are fascinating, but a young child isn’t equipped to safely handle the risks they bring.

If AI is a massive saltwater crocodile, the world is presently a five-year-old facing it down without oversight or proper safety equipment. According to the latest research from Pindrop, deepfakes generated using AI are a problem for three-quarters of security leaders – but only 10 percent are deploying deepfake detection tools to catch them. The fraud capabilities that generative AI has enabled are far outpacing organizations’ capacity to respond; for now, the tech is beyond what most businesses can handle. If we extend the metaphor to its grisly end, someone is going to lose a limb.

Pindrop’s Deepfake Readiness Index, released today, sounds a clear alarm. “Deepfakes are not just a nuisance or an isolated issue for your hiring or PR teams,” the report says. “Deepfakes are squarely a security issue, one that can lead directly to data theft and intrusion.”

Moreover, pointing to your bullet-proof vest won’t do any good. “You’ve likely already extended Zero Trust across your company, embedding verification across your network and systems,” the report says. “Yet deepfakes evade those controls; they pose a risk to every single live business interaction: phone calls into your helpdesk, remote job interviews, and sensitive virtual meetings with executives.”

Pindrop’s numbers illustrate the scale of the threat, showing that AI-driven attacks increased 1,680 percent from Q4 2024 through June 2026, and are growing eight times faster than traditional attack types.

“Until companies treat deepfakes like the serious enterprise threat they are, most will remain vulnerable.”

Existing tools can’t handle threat – but execs think they can

It’s not that companies don’t know this. Pindrop’s report shows that 93 percent of leaders are concerned they aren’t prepared for a deepfake attack. A quarter of affected organizations have already lost $1 million or more to a single deepfake incident. And 37 percent believe one successful attack could put them out of business.

Overconfidence in security defenses is a problem. Seventy four percent of surveyed leaders believe deepfake defenses will improve faster than attack quality. This underestimates the factor of pace: because fraud operations have no rules or compliance frameworks to adhere to, they are positioned to outpace protections, creating a reactive cycle in which fraudsters are always a step ahead.

More than 1 in 3 enterprises are still deploying legacy defenses that don’t stand a chance against current fraud tactics. These tools – IAM, SSO, MFA – are “no match for the scale and sophistication of today’s deepfake attacks,” Pindrop says, “largely because attacks are happening in channels that these tools weren’t designed to defend.”

Elie Khoury, SVP of research at Pindrop, says “attackers have figured out that one of the easiest ways around sophisticated security controls is to impersonate the human those controls are designed to trust.”

“Deepfakes turn our most instinctive signals of identity, a familiar face and voice, into an attack surface. Enterprises need to bring the same rigor used to secure systems and devices to the live human interactions where critical decisions are being made.”

If you can’t catch a whale, catch 100 tuna instead

One finding tells an underlying story of what really matters to leaders: 3 in 4 say “it will take a company leader being fooled or impersonated to make this a boardroom priority.” There is a reason the most notorious deepfake incident to date involved an injection attack that deepfaked a conference table full of executives: outside of celebrity businessmen, most executives don’t see deepfake fraud risk as something that applies to them.

Pindrop’s report refers to this as a prioritization problem: “while there’s real exposure, and respondents know sophisticated tools exist, this attack surface just isn’t prioritized in the boardroom yet.”

“Boardrooms still view deepfakes as a public figure or celebrity issue – one defined by manipulated videos on social media that spread like wildfire and make headlines. That framing made it easy for leadership teams to file deepfakes under ‘reputational risk for high-profile individuals’ rather than ‘persistent enterprise security threat requiring infrastructure investment.’”

Once again, a vulnerability identified as a security risk is a prompt for fraudsters to find a workaround. If targeting high-ranking executives is liable to trigger a robust response, attacks on lower levels of the ecosystem – IT help desks and contact centers, remote job interviews, virtual meetings and other real-time communication channels – could become the preferred targets: scores of small fish instead of one big one.

As fraud becomes ever-more sophisticated and losses mount, the bill will come due eventually. The report quotes Jim Routh, chairman of the CISO Deepfake Defense Council, who says “the security leaders prioritizing deepfake detection today are the only ones who’ll have a real answer when their board starts to ask questions.”

Pindrop draws a similar conclusion from its research. “AI has created a foundational identity and trust question that requires an equally foundational change in the security strategy for your real-time channels,” it says. “Those channels have now become identity checkpoints, where we can’t trust our eyes and ears. That’s exactly why a new layer of defense is needed.”

The Deepfake Fraud Detection Market 2026: Securing Identity in the AI Era

Article Topics

AI fraud  |  deepfake detection  |  deepfakes  |  enterprise  |  Pindrop