Dominic Jainy stands at the intersection of emerging technologies, bringing a wealth of experience in artificial intelligence and blockchain to the front lines of information security. As AI matures, his focus has shifted toward the ways in which large language models and synthetic media are reshaping the battlefield of social engineering. In an era where “seeing is believing” no longer holds true, Dominic’s insights help organizations navigate the complex landscape of digital identity and synthetic impersonation.
Our discussion centers on the rapid maturation of social engineering, exploring how the migration from email to multimodal deepfakes is rendering traditional security training obsolete. We delve into the critical need for CISOs to update their incident response playbooks and the structural shifts required to protect high-value workflows from sophisticated, AI-driven impersonation.
With over 40% of organizations reporting deepfake incidents during audio and video calls, how are these multimodal threats bypassing traditional security layers? Could you elaborate on the specific “detection cues” that are no longer reliable and describe the technical shifts necessary to verify identity in real-time?
The reality is that we are witnessing the death of the “uncanny valley,” where the glitches and robotic cadences that used to tip us off have smoothed into near-perfection. With 41% of organizations reporting deepfake incidents in audio calls and 36% in video calls within the last year, it is clear that our reliance on visual or auditory intuition is a failing strategy. We can no longer tell a colleague to “turn their head” or “blink twice” because the processing power behind these synthetic avatars has become too fast and too fluid for the naked eye to catch. This has transformed identity from a visual confirmation into a complex trust problem that requires a fundamental technical shift toward cryptographically signed identity markers. We must move toward real-time, out-of-band verification protocols where the “person” on the screen is backed by a hardware-bound credential rather than just a familiar face.
Email phishing remains a dominant threat, yet there is a significant migration toward vishing and smishing where trust is often higher. What specific high-value workflows, such as account recovery or payment authorization, are most vulnerable to this shift, and what step-by-step measures can be implemented to protect them?
Even though 79% of CISOs still deal with email-based phishing, the jump to vishing and smishing—reported by 58% of leaders—is where the most damage occurs because it feels more personal and urgent. Account recovery and payment authorizations are the primary targets because they represent the “keys to the kingdom” and the actual exit of funds. To protect these, organizations must first implement phishing-resistant MFA, such as FIDO2 security keys, which cannot be intercepted by a smooth-talking voice on the phone. Second, any request for a financial transaction or a privilege change must trigger a mandatory “call-back” on a pre-established, trusted channel that is separate from the one where the request originated. Finally, we need to embed identity abuse detection that flags suspicious behavior immediately after a password reset, such as a sudden large transfer to a new vendor.
Security awareness training has long focused on teaching employees to “spot the fake,” but experts now suggest this is insufficient. How can a company transition its culture toward a “secure verification” standard, and what metrics should leadership use to measure the effectiveness of this new behavioral approach?
The old mantra of “spotting the fake” is a losing game when the fake is indistinguishable from the truth; we are essentially asking employees to be more accurate than sophisticated algorithms. Instead, we must transition to a “secure verification” standard, where the culture mandates a “pause and verify” step for every consequential request, regardless of who it seems to come from. This isn’t about being paranoid—it’s about making security a standard operating procedure like a pilot’s pre-flight checklist. Leadership should stop measuring success by how many people clicked a simulated phishing link and start measuring the “time to report” and the adoption rate of verified communication channels. If a CFO receives a deepfaked video call and immediately initiates a secondary verification via a secure internal app, that is the ultimate metric of a successful security culture.
As attackers begin to manipulate AI recommendations and compromise out-of-bounds AI agents, how must incident response playbooks evolve to keep pace? What specific data points should CISOs correlate—such as privilege changes or new device registrations—to identify a sophisticated impersonation attempt before a transaction occurs?
Incident response playbooks have historically been siloed, focusing on a single point of entry, but the multimodal nature of modern attacks requires a much more holistic “web of evidence” approach. When an attacker uses a deepfake to gain access, the playbook must trigger an immediate correlation of seemingly unrelated events, such as a new device registration followed by a sudden escalation in administrative privileges. We need to look for “islands of activity” where a user is performing high-risk actions—like adding a new financial recipient—right after a suspicious account recovery event. By monitoring these specific data points in real-time, security teams can freeze transactions before the money leaves the building. The goal is to move from reactive remediation to proactive, risk-based identity control that flags the impersonation long before the “submit” button is even pressed.
Identity and access risks are increasingly becoming the primary battleground for AI-driven social engineering. In terms of phishing-resistant authentication and risk-based controls, what are the practical trade-offs between strict security protocols and employee productivity that organizations must balance?
There is always a visceral tension between the friction of security and the fluidity of work, but the 79% phishing success rate we’ve seen lately suggests that the cost of “ease” has become far too high. Implementing phishing-resistant authentication can feel like a hurdle for a busy executive, but the sensory relief of knowing a session cannot be hijacked provides its own kind of peace of mind. We balance this by using risk-based controls that only step up the friction when the context changes, such as when an employee logs in from a new location or attempts a high-value payment. This “just-in-time” security ensures that for 95% of the day, the employee is productive and unhindered, but for those critical 5% moments, the armor is impenetrable. It’s about being surgical with our security measures rather than just building a higher wall that everyone eventually tries to climb over.
What is your forecast for the evolution of multimodal deepfakes in the corporate environment over the next few years?
In the coming years, we will see deepfakes evolve from being isolated “attack tools” to becoming persistent, synthetic identities that can maintain a long-term presence within a corporate network. We will likely move beyond simple video calls to “agentic” deepfakes—AI-driven personas that can participate in text chats, emails, and calls simultaneously, creating a multi-layered illusion of a real employee. The barrier to entry will drop so low that even low-level scammers will have access to high-fidelity impersonation tools, making every digital interaction a potential risk. Consequently, the only path forward for the enterprise will be a “Zero Trust” approach to human communication, where digital identity is verified by mathematics and cryptography rather than sight and sound. The companies that survive this transition will be those that accept that the human senses are no longer the primary guardians of the corporate perimeter.