Vol. 3 of 25
·
Attacker tactics and validation
The open helpdesk door
The helpdesk is the only place where a human must be able to override the authentication system. Audio and video deepfake tools are now consumer products. This makes the helpdesk the point in your environment where attackers most frequently attempt to bypass controls.
87%
of organisations affected by AI-based attacks encountered audio or video deepfakes. Source: HYPR / S&P Global 2026.
45%
of AI attack victims encountered pre-recorded deepfake video. Source: HYPR / S&P Global 2026.
43%
of AI attack victims encountered deepfake audio in live calls. Source: HYPR / S&P Global 2026.
The assumption
Knowledge-based authentication (KBA) and visual verification via video call are sufficient to keep the IT helpdesk secure during password resets. The unstated belief is that diligent human review cannot be deceived without physical presence.
The reality
Audio and video deepfake tools are designed to deceive visual verification. This makes the helpdesk the primary bypass target. Scattered Spider used social engineering against helpdesks to gain initial access. The group impersonated employees to obtain password resets, even before AI-generated media was widely available.
The target architecture
Eliminate helpdesk security questions. Deploy cryptographic identity verification with biometric liveness detection for all account recovery workflows. The objective is to replace subjective human trust with cryptographic proof that a deepfake cannot generate.
Three-tier account recovery
Tier 1, security key binding: The recovery request must originate from an enrolled device, such as a hardware security key. This covers most legitimate requests.
Tier 2, biometric liveness verification for lost devices: If a device is lost, stolen, or damaged, AI-driven identity verification with active liveness testing replaces the human verification call.
Tier 3, out-of-band manager attestation: For privileged accounts, a signed attestation from the direct manager, delivered via a separate authenticated channel, provides a second independent signal.
Sources
HYPR / S&P Global 2026
CISA, Cybersecurity Advisory AA23-320A (Scattered Spider)
Hong Kong Police Force, February 2024 (Deepfake fraud)
MITRE ATT&CK T1656 (Impersonation)
Would you like to assess your environment?
Book a walkthrough with Ciptor. We will review your assumptions together.
Book a walkthrough