With the rise of genAI, vishing attacks are becoming more realistic and, as a result, more successful than ever before. But there are ways for organizations to protect their employees—and their data—against these attacks.
The Big Picture: The second half of 2024 saw a huge surge in vishing (“voice phishing”) attacks, which rose by 442%. But vishing today doesn’t look like it did a few years ago; genAI-powered voice cloning and deepfakes are making these attacks more realistic—and, as a result, more difficult to identify—than ever before. Additionally, the use of AI is making it much easier for threat actors to carry out vishing attacks. This means AI-powered vishing is not only enabling these attacks to become more targeted, but it’s also enabling attackers to carry out more of them.
Driving The Issue: Quite simply, deepfake vishing attacks are very difficult to identify, and threat actors are already using it in the wild. Charles Henderson, EVP of Cybersecurity at Coalfire, tells Expert Insights:
- “The impersonation capabilities of AI betray what we think of as possible. When you see someone’s face and hear their voice, you don’t have that skepticism. That means you’re far more likely to fall for these types of attacks.”
Deepfake attacks are not only feasible, but very effective as well, Henderson says.
- “You’re already seeing cases where threat actors are using this in the wild. It’s not some sort of weird Hollywood plot. Early adopters in the threat actor space are demonstrating that it works. And now you’re starting to see the more established threat actors say, ‘Hey, if this works, let’s bring this attack vector up to the big leagues.’”
What’s The Solution? There isn’t a single point solution that can solve the deepfake problem, says Henderson. Instead, organizations need to develop a defensive strategy that safeguards against human error.
- “Simulating these attacks safely is something that we do, but that’s not the be-all and end-all. It’s also important to set up processes and procedures such that, even if these attacks are successful, there’s something on the back end that safeguards your systems and processes, and you’re not relying on a lack of human error.”
- “Look at defensive strategies like threat hunting to see if something already occurred. It’s one thing to close the barn door; it’s another thing to close the barn door when the horse is already out. So, looking around the environment to find out whether there are indicators of compromise or evidence of data leakage.”
The Bottom Line: “It’s really important that you start thinking about the fact that this can affect anyone in your company; regardless of how intelligent or amazing you feel an employee is, they can still make mistakes. You need to make sure that, if they make a mistake, it’s not catastrophic for the company.”
Listen to our interview with Charles Henderson, EVP of Cybersecurity at Coalfire here.
Expert Insights provides leading research, reviews, and interviews to help organizations make the right IT purchasing decisions with confidence.
For more interviews with industry experts, visit our podcast page here.
