Gartner’s September 30, 2026 release says deepfake threats are mainstream, and that CISOs should drive a process change: recognition is not an acceptable basis for authorizing a decision or an action. Detection software is one layer. Gartner also names contextual signals, additional authentication, and checks on content provenance.
The rule
Write it in one sentence your accounts-payable clerk can repeat. Example: no payment, mailbox rule, or vendor-bank change is approved on a voice, a video, or a familiar writing style alone. A second channel, already on file, has to say yes. If you cannot write the sentence, the current process is “we know our people.”
The redesign
- List the actions that move money, data, or access. Those are the ones recognition must not unlock.
- Name the second factor that already exists: a callback to a number on the vendor master, a hardware key, an approval in the system of record. Do not invent a new app if the second factor is already policy and simply unused.
- For public content, ask where a synthetic image or audio came from before it goes on a site or into a customer message. Provenance is the check Gartner pairs with detection.
- Tell staff that matching a voice is not a failure of attention. It is the attack.
FAQ
Does this replace multi-factor authentication?
No. It stops MFA from being bypassed by a person who sounds right and asks the help desk to turn MFA off.
Is a deepfake detector enough?
Gartner’s sentence includes detection and the other layers. A detector that is wrong in either direction will still approve the familiar voice if the process allows it.