What happens to identity security when an attacker can copy an executive's voice, face, and employment history using inexpensive tools?
In this episode of The Business of Cybersecurity, I speak with Bojan Simic, CEO and co-founder of HYPR, about the effect of generative AI on impersonation, credential recovery, and help desk security. HYPR is a New York cybersecurity company focused on identity-based attacks. Bojan says identity-related events account for between 60 and 80 percent of incidents, depending on the security report being used, and his team helps organizations find and repair weak points across the identity chain.
The demonstration during our conversation makes the risk unusually tangible. Bojan changes his on-screen face into mine using software running on his local computer. The result is not flawless, but it is convincing enough to show why a familiar face on a video call can no longer be accepted as evidence by itself. With additional preparation, an attacker can also clone a voice, gather employment details from public profiles, and automate much of the reconnaissance that previously required repeated manual calls.
Bojan argues that asking employees to recognize every deepfake repeats an old cybersecurity mistake. Phishing simulations showed how quickly people return to normal working habits after training. Help desk staff are trying to resolve problems, support colleagues, and close tickets. They should not be expected to determine whether a distressed caller, senior executive, or remote employee has been digitally recreated.
One hospital example illustrates the weakness of knowledge-based checks. According to Bojan, an attacker called the help desk while pretending to be a doctor but did not know the required four-digit PIN. The attacker then called the doctor while posing as the IT team, obtained the PIN, returned to the help desk, and gained access to the account. The process technically followed policy, yet the policy relied on information that could be socially engineered.
We discuss how the same attack can become faster through AI. A system can call the help desk, discover which questions are asked, search public sources for the answers, call the employee when information remains missing, and return with the required details. Requiring video does not solve the problem when faces can also be recreated.
The conversation also covers continuous identity proofing. Instead of treating verification as an event completed during onboarding, companies can request stronger evidence when behavior changes. A new device, unfamiliar operating system, first-time access to a sensitive application, return from a long absence, or promotion into privileged access can all justify another check. Routine work from a known device should remain straightforward, allowing friction to appear when the risk changes rather than during every action.
Privacy deserves equal attention. Bojan acknowledges that employees in some countries may resist location, document, or biometric checks. His recommendation is to explain what is collected, whether it is retained, and what alternatives exist. An employee who declines remote verification can be offered an in-person process. That gives people a choice while preserving the security requirement.
The most immediate action is to test password recovery and credential reset. Bojan advises moving those functions away from phone-based help desks and into a self-service process that combines device, location, or document verification. He says credential resets account for roughly 30 to 40 percent of help desk calls, so the change may also reduce support demand.
Could a cloned executive, remote worker, or doctor pass your current recovery checks, and which independent signal would stop them? Listen to the episode and share your thoughts with me.
[00:00:00] Scale your business with agentic AI, with limited risk. With Denodo's AI data layer, your agents are provided with real-time company data and guardrails for company protection. Create the business you always dreamed of with Denodo, and you can do that by simply visiting denodo.com to learn more. But now, back to my guest.
[00:00:29] What can an organisation trust when a caller's voice, face and personal history can all be copied? Well, in this episode of The Business of Cybersecurity podcast, I'm going to be speaking with the co-founder of HYPR. We're going to talk about how deepfakes are changing identity verification and account recovery in the workplace.
[00:00:55] He's going to demonstrate the problem in real-time by replacing his face with mine during our video call today, which is mildly alarming when you have thousands of hours of public audio online. And we will also discuss why asking your employees to identify deepfakes or convincing fakes cannot carry the burden, and how attackers manipulate helpdesks, and why passwords, pins and personal questions provide very weak evidence.
[00:01:25] And he'll also explain continuous identity proofing, and the case for combining device, location, document, and deepfake checks, all without being creepy. So, if an attacker can look like any executive or your CEO, what should prove that that person is genuine? Well, we're going to get to the bottom of this today. Okay. So, let me introduce you to my guest right now.
[00:01:53] So, thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do? Yeah, my name is Boyan. I'm the co-founder of HYPR. We are a cybersecurity company based in New York City, and I've been here for 12 years since we started it. And we primarily help companies with identity-based attacks.
[00:02:17] So, depending on which security report you read every year, anywhere between 60% to 80% of cybersecurity incidents are due to an identity-related event. And we help our customers identify what the weakest link in the identity chain, as we call it, is in their environments, and help them try to fix it. So, we've been doing that for over a decade, and there is no shortage of work, I'll tell you that.
[00:02:46] Yeah, I can well believe. And I must admit, one of the things that scares me, especially as a podcaster with 4,000 episodes of my voice out there, is we're seeing attackers clone voices now, in particular executive voices, from even just a few seconds of public audio. So, I mean, when you hear stuff like this, what does that change about the way organizations should think about identity and trust? Especially because you guys have been doing this for, like you said, over a decade now.
[00:03:14] So, it seems like a big change here, cloning people's voices. Yeah, cloning people's voices, cloning people's faces. It's all very easy to do now. These types of things were possible five, six years ago, but they weren't cheap to do or easy to do. And now, you can clone anybody's voice, you can clone anybody's face with five minutes of time using free tools.
[00:03:41] And now, when we speak to somebody on the phone, or if we're on a video chat like this, it's a very different ballgame, especially when it comes to situations that require trust. Many of us have read the news articles where we've seen people sending $25 million to somebody that they weren't supposed to. We've seen the situations where the person who gets interviewed isn't the person who is really doing the job.
[00:04:11] We've seen instances where you get a phone call and it sounds like your child or your niece or somebody who's close to you and they're clearly in distress and they need $500 immediately to get out of a particularly sticky situation. And it turns out it's not them. And so, these scams are becoming much more prevalent and the barrier to entry is lower than ever.
[00:04:38] We used to kind of depend on, oh, this person speaks with a different accent or they don't speak English very well. It's a scam, so on and so forth. That variable simply doesn't exist anymore. And there'll be some people listening that are very proactive on stuff like this, like to think they're ahead of the game, maybe improve their compliance training or cyber awareness training. But I was reading that you've argued that asking employees to spot a deep fake is almost a losing game.
[00:05:08] So why is this maybe more of an architecture problem rather than a training problem? Yeah, look, relying on humans to spot security issues has never worked. Yeah. And we learned this with phishing emails, you know, where we would send a phishing email, you know, 10% of the company would click it. We would give everybody training thinking it improves that we sent another phishing email test to the whole company and 30% of the company clicks it. It's like, oh, come on.
[00:05:37] You had the training two weeks ago. Why are you clicking it? So the user training is, look, it has its place, but it really doesn't work. Most people are just trying to go about their day. And so what we need is we need more deterministic sets of controls. And we need technology that helps organizations keep their employees safe. And the technology that companies are using right now to verify people just isn't sufficient.
[00:06:06] Or in most instances, frankly, they're not using technologies. I was speaking with a security leader at a hospital system last week. And I asked him, so what's the process right now? If somebody calls up your help desk and says that they're a doctor in your environment and they need access to the system. And they're like, well, they'll ask you for a four digit pin. And I'm like, OK, well, what's that four digit pin?
[00:06:32] He's like, well, you know, it doesn't change the same as long as you're an employee here. And so what happened in their situation and the reason we were talking is the hacker called the help desk pretending to be the doctor. They asked for a four digit pin. The hacker didn't know the pin, so they hung up. Then they called the doctor and said, this is your IT team. We're doing an audit of your pin. Can you tell me your pin?
[00:07:02] Doctor said, absolutely. Here it is. Thank you. Hung up, called the help desk back, answered the question and got access to the doctor's account, which had all sorts of health care relevant information and data and caused all sorts of headaches for the team. So if we're relying on methods like that to verify somebody's identity, I think we're going to keep seeing these issues persist. Wow.
[00:07:29] I mean, you have a great example there inside a hospital. If we go anywhere in corporate America or any big company there, can you walk me through how a convincing voice call to, let's say, the IT help desk might become an account takeover, even when the organization has invested heavily in multi-factor authentication and all the usual security measures? Walk me through a call like that that would take place every single day in an organization. Yeah, look, the hacker will usually do reconnaissance.
[00:07:59] And I'll kind of also speak how these attacks are evolving. So the attacker will call the IT help desk and they'll pretend to be Neil, let's say. And then Neil will say, and then the help desk person will say, well, give me your, the date that you started, your manager's name, some other similar information. And the hacker will say, I don't have time for this right now. And they'll hang up. Yeah.
[00:08:25] And then they'll go call Neil and get the answers from Neil, pretending to be their IT team. Or they'll find this information on LinkedIn. I can see the date that you joined at the company. And I can see that your manager left you a recommendation. And so I'll say that's your manager's name. I'll call back and answer those questions and then get access to your account. Now, two years ago, this was a manual process.
[00:08:55] Now with AI, well, guess what? Yeah. I can sound just like you in case the help desk person knows me. But at most big companies, they don't. I can also now automate this entire process where the AI can call to help this, figure out what those questions they need to get answers for is. Then the AI can go on LinkedIn, find this information and then call back. And then at the end of the day, the AI just gives the hacker the credentials.
[00:09:26] And then the hacker does what they need to do with them. Now, some help desks have moved to like say, hey, if you're trying to change your password or you're trying to get your MFA, a phone call isn't going to do it. I need to see you face to face. I have your photo here in the system. I need to know that it's you. And the hacker will do something like this. Or now I'm Neil. Right.
[00:09:54] That is crazy. Right. And the hacker will be like, hey, I need to reset my credential. And if, you know, if they had five more minutes of their time, they would also make it a convincing voice clone. But it's that simple. You are my brother from another mother, my friend. I tell you, that is amazing.
[00:10:16] I mean, seriously, if a voice, face, password and personal history can all be copied or even stolen, what evidence should an organization require before granting access or resetting credentials? What should they be doing here? Yeah. So it's not any single thing. It's a series of things that organizations can do. So one is most people have a mobile device these days. And that mobile device can tell a lot about you.
[00:10:47] And so even though I can pretend to be Neil over this video call, I don't have your phone. Yeah. Right. And so what you can do is you can do a number of factors. You can verify this person's mobile device, you know, through a secure message. You can also ask the person to go on a website on their mobile device, which will then check their location. So, hey, Neil should be in the UK. He shouldn't be in Vietnam.
[00:11:17] Yeah. And then another level of security that can be done is relying on the presence of a government issue document. Although those can also be fakes now. The ones with the chips in them that you can just tap against your phone are much better because you can't fake the chips. But you can't fake potentially an image of a document.
[00:11:43] And then there is a number of solutions, including ours out there now, that will help organizations do deep fake detections on a video stream. So if you and I are on a video chat like this and I try to be Neil, there are solutions that will help us determine whether or not that's the real Neil or not.
[00:12:07] And any one of these controls on their own are not strong enough. But if you chain two or three of them together, then you have a much higher level of assurance that this person is who they say they are. And if they fail those controls, then you may require them to go in person or to be in a better environment where they can pass those controls.
[00:12:31] But relying on knowledge based factors, something that I can share with someone or something that can be figured out about me and provided on my behalf is going away very quickly because businesses just can't rely on that anymore. And a phrase I hear more and more recently is continuous identity proofing. But what does that mean in everyday operations?
[00:12:56] How can a business maybe introduce it with without creating an exhausting experience for its employees and are quite resistant to extra friction, even if it is in their best interest? Yeah, this is where like behavior profiling of users and things like that becomes particularly important right now. The way that most organizations work from an identity security perspective is once you get through the front door, you just have access to all things. Yeah.
[00:13:23] And that is particularly dangerous because in a digital world, I can copy the front door. And so if there's infinite copies of the front door, potentially, then it's not very secure. Um, so what businesses are doing from a continuous perspective is how do we make sure that this person who is who they say they are from the first interview to on to onboarding to, uh, to elevated access.
[00:13:53] So if you're an employee at a company in America or anywhere else, 95% of the time you're going to be in front of your computer doing your work. Um, and if you log into your computer and you access that system with a valid credential, you should be able to have the least friction experience as humanly possible. But if Neil is working on a Mac book today, and then 10 minutes later, he's accessing something from a windows machine. Uh, I need to know it's you.
[00:14:23] Yeah. And chances are, if you're, if you're acting, uh, if your behavior is different, chances are you're probably okay with some friction to make sure that it's you. Um, so we're seeing organizations making this identity verification process, not a one-time event, but something that employees have to do when they access systems they've never accessed before. Uh, if they get promoted and they get escalated, they get elevated privileges as part of that.
[00:14:51] Uh, if they go on a sabbatical or leave for two, three months and they come back, Hey, before we just let you through the door again, we're going to need to verify you. And this is very popular with contractor populations or, um, remote employees in particular, where those are, those are people who are most likely to perpetrate the fraud.
[00:15:14] Um, where we've seen the news where, you know, there's a laptop farm in Tennessee somewhere, and there's 30 laptops there. And there's North Koreans remoting into the laptops and working as American employees. Um, but it's how do you prevent these scenarios? Because what happens a lot of times is an employee will get a job. They'll want to collect two or three different salaries at the same time.
[00:15:42] And so they'll on the sixth or seventh day on, on the job, they'll take their credentials and they'll give it to somebody in a different country. And then that person will start doing their job for them. And that person will join meetings every once in a while, so on and so forth to keep up a facade. It's not really them doing the work. So if you just verify them on the first day, that's not really enough to have the confidence moving forward. Wow. That's incredible.
[00:16:07] And of course, human judgment will remain part of many support and approval processes. So for people listening, how should their organization help their employees maybe challenge a parent or sorry, when a caller sounds exactly like a senior executive, they're going to be nervous about calling out the CEO as a fake or something like that and getting into hot water. So what should they be doing? That's what happens a lot of times is the, is the, the help desk is terrified.
[00:16:35] They're like, well, if the CEO or the CFO calls and they're locked out, you know, we're potentially causing the business millions of dollars of losses if we don't help them right then and there. Yeah. Um, the fact is there does need to be support for such an initiative, um, in a broader sense. What we've seen companies do is dedicate a specific team or set of individuals who just help the executive team themselves.
[00:17:03] So if an executive, um, uh, calls up, if executor calls a help desk and they need help, it gets immediately routed to somebody who knows how to do the proper security checks and somebody who knows their schedule and where they should be and how they work. Um, instead of a random help desk person that doesn't know that individual, um, or, or how they operate. So that's, that's the bucket for the executives and the special people at the company for everybody else.
[00:17:33] What we've seen companies doing more and more is actually take away the functionality or the ability for the help desk to issue a new credential. The help desk can help you with your email being slow, or you can't open that Excel spreadsheet or whatever. But if you try to change a password, you can't do it.
[00:17:50] You have to go through a web-based self-service portal where you do those verification steps, where you verify your device, your location, your documents, so on and so forth, uh, in order to then be issued a new credential. So that becomes an automated self-service process, which people like, by the way, most people who, you know, are, are started their careers in the last 15 to 20 years. They hate using the phone. Yeah.
[00:18:18] You know, like the phone is the method of last resort. If the, if I'm picking up the phone to call somebody, something is terribly wrong. So, um, I prefer a self-service method and, and, you know, most people, uh, who, who are in the workforce now are tech savvy enough to go through such a process. And as we started earlier, stronger verification. Yes, it can reduce fraud, but it can also increase friction. We've mentioned that a little also maybe that the feeling of surveillance.
[00:18:48] Surveillance being surveilled and privacy concerns. Do you see any, um, any pushback on things like that? How do leaders manage that trade off? Or are most people pretty open to, uh, reducing the risk? What, what have you seen there? Yeah. I mean, look, there's, there's, uh, certain countries, the French Germans, so on and so forth that have, um, a particular view on the privacy aspect. Yeah.
[00:19:16] And, and the, the separation between work and life. Um, and the, the thing there is don't let that stop, we're going to stop your business from improving more, more modernized security controls. Um, and what, what we're seeing businesses do is, is tell those users who are in those places or individuals who refuse to provide data, um, in order to securely verify them.
[00:19:45] Tell them you got to come in person. I mean, you know, come work from work for a day. So that's what those companies are doing. Um, and look, as long as you give people options, they will usually choose the one that's most convenient for them. Right. There are many people in those situations are very quick to say, no, I'm not going to do that until they have to do something a little bit less convenient.
[00:20:15] Then they actually look into it. And when they actually look into it, then they realize, oh, look, there is no data retention of this information that happens. They're not actually storing my documents or my biometric data in these instances. Um, my company already has my phone number and they already know where I live. So sharing my, you know, verifying my phone and my location isn't that big of a deal.
[00:20:38] And so, so I think, uh, you know, once they actually see that it's not nearly as invasive as they think it is initially, they'll do it. Um, or they can just get in their car and drive to a office and be verified. And I suspect today from the moment you shapeshifted into me for a few moments, you might have set off a few alarm bells here. So for everyone listening here, try and give them an actionable takeaway.
[00:21:05] What is that one identity recovery or helpless process that every organization could maybe go away after listening to this and test now to discover whether a convincing deep fate could bypass them? Yeah. Yeah. So the baseline that I would do is, is use a self-service capability that has a combination of, uh, phone verification, location, verification, and a document verification. Yeah.
[00:21:34] You don't have to do all three of those two out of three is better than a four digit pin that anybody can guess. Or some knowledge-based question that, uh, somebody on can find on your LinkedIn. So that's, that's the first thing I would recommend is, is find a way to move away from knowledge-based factors as quickly as possible.
[00:21:56] Um, and, and ultimately look for a way to take this, um, take the credential recovery and password reset out of the hands of the help desk. The help desk is there to help. Yeah. Ultimately they are motivated by the speed at which they can close a ticket. They are not motivated by their ability to secure the business.
[00:22:22] And I don't think that's a fair thing for us to assume of them to do, uh, or to expect them to do. So I think, you know, taking away those controls from the help desk and making it self-service is key. And they're going to have a better life too, because about 30 to 40% of phone calls to help desk are credential resets. Hmm. And I think that is a powerful moment to end on.
[00:22:49] And today you've proven in real time, how attackers can scrape three seconds of audio from an earnings call or webcast, clone a leader's voice, or even a face and ask IT to help and let them in. So anybody listening wants to continue this conversation today with you, where, where's the best place to find you and your team online and dig deeper on some of the things we've discussed. Where should they go? Yeah, look, our website, hypr.com, uh, find us on LinkedIn. We're on there.
[00:23:18] Um, and, and yeah, looking forward to the discussions and, um, if anybody has any tips on how to make this process better, easier, um, we'd love to hear your experiences as well. Yeah. Yeah. I would love anybody listening. I've had a similar experience to message me as well over at tech talks network. And one of the big messages from today is, is this, the problem we're talking about is more bad architecture rather than gullible employees.
[00:23:45] I think for too long, we've seen those headlines of all which humans are the weakest link insecurity. And it's a much bigger problem than that. And it's great to see you address that in real time today. I'll include links to everything. I urge people to check that out, but thank you for raising this today. A big, important topic. Appreciate you, Tom. Thank you, Neil. I think that demonstration in the episode there makes the problem impossible to dismiss. Organizations do not need one perfect test.
[00:24:15] They need two or three independent signals that are difficult for an attacker to copy at the exact same time. And the immediate task here is to examine password recovery and credential reset. Moving these actions from phone-based help desks into verified self-service processes could protect the business while removing the pressure from employees that are measured by the speed of the tickets that they close.
[00:24:42] So a big thank you to my guests for becoming my digital twin without stealing the podcast and for explaining what better identity architecture looks like. You'll find links to everything in the show notes. Let me know your thoughts if you've had any experiences or anything to share on this. Let me know. And ask yourself and people in your organization, do you think a convincing fake could pass through your recovery process today? As for me, techtalksnetwork.com.
[00:25:12] That's where you find all the episodes and different ways of meeting me or working or connecting with me. That's it for today. Speak to you again real soon. Bye for now. Bye.