StealthTech
A controller at a mid-sized manufacturing firm gets a video call from her CEO. He’s on-screen, his voice is right, his mannerisms are right, and he’s telling her to push through an urgent wire transfer before a vendor deadline. She does it. Twenty minutes later the real CEO walks past her desk, and neither of them has any idea what just happened until the bank confirms the funds are gone. That scenario has already played out at real companies, and the tooling required to pull it off is now cheap, fast, and available to anyone willing to scrape a few minutes of a target’s voice from a webinar or an earnings call.
This isn’t a future threat. It’s a current one, and it’s landed squarely on the desks of finance teams, executive assistants, and IT leads at exactly the kind of mid-market companies that make up the defense industrial base. If your organization handles Controlled Unclassified Information, works under a prime contract, or is preparing for a CMMC assessment, you already know your compliance posture gets scrutinized. What often doesn’t get scrutinized with the same rigor is whether your people can tell the difference between their actual CFO and a synthetic voice built from three minutes of a company town hall posted on YouTube.
Why Synthetic Media Attacks Have Moved From Novelty to Standard Toolkit
Voice cloning and video synthesis used to require real production value: hours of clean audio, specialized software, and someone who understood how to use it. That barrier is gone. Commercial and open-source voice cloning tools now need somewhere between three and thirty seconds of clean audio to produce a usable clone, and video generation tools have closed the gap fast enough that live “deepfake” video calls are no longer a research demo they’re a documented attack vector used against real companies, including a well-publicized case where a finance employee at a multinational firm transferred more than twenty million dollars after a video conference call with what he believed were several senior colleagues, all of whom were synthetic.
The economics are what changed the threat model. A criminal group no longer needs technical sophistication to run this play; they need access to a marketplace of cheap tools and a target with predictable financial workflows. Defense contractors and their subcontractors are unusually good targets for this because their financial and organizational structures are often public by necessity SAM.gov registrations, press releases about contract awards, LinkedIn profiles listing exact titles and reporting lines. An attacker researching a target company for a business email compromise attempt already has most of what they need to build a convincing pretext; adding a cloned voice or a fabricated video call is now just the next step in the same campaign, not a separate skill set.
There’s also a subcontracting dimension that tends to get overlooked. Prime contractors and larger primes have generally invested in security awareness programs that at least mention synthetic media risk. The subcontractors underneath them the twenty-person engineering shop, the machining outfit running three shifts, the small accounting firm handling a prime’s invoicing often haven’t, even though they’re handling the same flow-down requirements and the same categories of sensitive information. Attackers know this. A cloned-voice call impersonating a prime’s program manager, directed at a smaller subcontractor’s accounts payable clerk, exploits exactly the trust asymmetry that makes subcontract relationships work in the first place: the smaller company wants to be responsive, doesn’t want to seem difficult, and often lacks the internal verification layers a larger organization would have built by default.
How These Attacks Actually Get Built
Most of what gets called a “deepfake scam” isn’t a single deepfake at all it’s a layered social engineering campaign where synthetic media is the final trigger, not the whole attack. The reconnaissance phase looks like ordinary OSINT: attackers pull audio from investor calls, conference panels, podcast appearances, or internal town halls that got uploaded somewhere public. They cross-reference org charts, vendor relationships, and recent news to build a plausible scenario an “urgent acquisition,” a “confidential vendor payment,” a “last-minute contract amendment” that needs to move before a deadline.
The synthetic component gets introduced at the moment of highest urgency and lowest scrutiny: a late-Friday phone call, a voicemail left for someone who’s traveling, a quick video call squeezed between meetings where the resolution is bad enough that facial artifacts are hard to notice anyway. Attackers understand something about human psychology that a lot of security awareness training undersells people don’t verify identity carefully when they’re being asked to act fast for someone they respect. The whole design of these attacks is to compress the decision window so the target never gets to the “let me call you back on a number I already have” step.
This is also why these attacks increasingly show up alongside more familiar techniques. A well-timed deepfake voicemail followed by a flood of legitimate-looking MFA push notifications is a documented combination attack pattern one channel builds urgency, the other exploits fatigue. If your team hasn’t already read through how MFA fatigue attacks work, it’s worth understanding that these threats are rarely used in isolation.
The Specific Exposure for CMMC-Scoped Organizations
Defense contractors carry a particular kind of risk here because the payoff for an attacker isn’t limited to a wire transfer. A convincing executive impersonation call can also be used to request credential resets, push an “urgent” software installation that’s actually a remote access tool, or get an employee to email a CUI-scoped document to an external address under the guise of a rushed compliance request. Once that data leaves your controlled environment, you’re not just dealing with fraud you’re dealing with a reportable incident under DFARS 252.204-7012, which requires rapid reporting of any cyber incident that affects covered defense information or the systems that touch it.
This is also where CMMC assessors are starting to pay closer attention. Social engineering resistance shows up across several practices in NIST SP 800-171, particularly around awareness and training, access control, and incident response and an assessor asking how your organization verifies unusual requests before acting on them is a fair question to expect. A System Security Plan that documents technical controls but says nothing about identity verification procedures for financial or data-access requests is missing a control area that’s becoming harder to ignore. If your organization is working through its compliance roadmap toward CMMC certification, this is a good moment to fold synthetic-media risk into the same conversation as your broader cybersecurity program rather than treating it as a side issue.
It’s worth being precise about why this matters beyond the immediate fraud loss. A successful impersonation attack that results in unauthorized disclosure of CUI doesn’t just create a reputational problem it creates a documentation problem during your next assessment cycle. Assessors reviewing incident response practices will ask what happened, how it was detected, how it was reported, and what changed afterward. An organization that can point to a documented verification protocol, a training record showing staff were prepared for this specific threat category, and a clean incident response trail is in a fundamentally different position than one that has to explain why a wire fraud attempt was never logged anywhere. The gap between those two outcomes is entirely a function of whether this risk was treated as a formal part of the security program before an incident happened, not after.
Detecting a Fake Voice: What Actually Holds Up in Real Time
There’s a lot of advice circulating about “listen for robotic tone” or “watch for unnatural pauses,” and most of it is already outdated. Current voice cloning tools handle prosody, breathing, and regional accent well enough that tone alone is an unreliable tell. What still works is testing the call’s behavior rather than its sound quality:
- Ask a question the real person would know but that isn’t publicly documented anywhere not a security question from a form, something contextual, like a detail from a conversation you had last week that never got written down or posted.
- Introduce unexpected friction. Ask them to repeat a specific number or name back in a different order, or ask them to respond to something slightly off-topic. Real-time voice generation still struggles more with improvisation than with scripted or predictable exchanges.
- Pay attention to how the call was initiated. A legitimate urgent request from an executive almost never arrives exclusively through a channel you didn’t initiate and can’t verify independently if the only way to reach “them” is the number that called you, that’s the red flag, not the voice quality.
- Watch for a request that conveniently short-circuits your existing approval process. Attackers design the ask to feel like an exception to policy, not a routine transaction.
None of these are foolproof individually, but together they shift the target from evaluating audio quality which the attacker controls to evaluating behavior under pressure, which the attacker doesn’t.
Detecting a Fake Video Call: The Tells That Still Exist
Live deepfake video is harder to pull off convincingly than a pre-recorded clip, and it still leaves artifacts if you know where to look, though the window for these tells is shrinking every quarter. Lighting consistency is one of the more reliable indicators: synthetic overlays often fail to match the light source and shadow behavior of the rest of the frame, especially around the jawline and ears. Eye behavior is another a lot of face-swap and avatar-based video generation still produces blinking patterns that are slightly too regular or eye contact that doesn’t track naturally with the conversation.
Audio-video sync under stress is worth watching closely. Ask the person to turn their head, or ask a question that requires an unscripted physical reaction reaching for a document, checking something off-screen. Real-time generation pipelines tend to degrade fastest under exactly this kind of unplanned movement, producing brief artifacts around the mouth or a lag between speech and lip movement that a scripted call would never expose. And just as with voice, the fastest verification isn’t visual at all it’s asking to switch to a different, independently-verified communication channel mid-call and seeing how the other party reacts to that request.
Building a Verification Protocol That Survives Contact With Urgency
Awareness training helps, but it doesn’t hold up against a well-executed impersonation attack unless it’s backed by a concrete, low-friction verification procedure that people will actually use when they’re under pressure. The organizations that handle this well share a few common elements:
They establish a callback rule for any financial request, credential change, or data transfer that arrives through voice, video, or messaging rather than an approved system the requestor gets called back on a number pulled from an internal directory, never a number provided in the request itself. They set a dollar threshold and request-type list that automatically requires two-person verification regardless of who’s asking or how urgent it sounds, and they make that threshold known company-wide so no one feels like they’re second-guessing a superior by following it. They designate a verification phrase or shared code that rotates periodically and is never sent over the same channel being verified. And they build a “no penalty for slowing down” culture explicitly into policy, because the single biggest predictor of whether these scams succeed is whether the target feared the social cost of pausing to verify more than they feared the financial cost of being wrong.
None of this requires exotic technology. It requires documented process, leadership buy-in, and a communications infrastructure your team actually trusts which is one of the reasons a lot of our clients moving to cloud-based VoIP systems build call-verification workflows directly into their phone infrastructure rather than treating it as a separate manual step.
Where AI Governance and Fraud Prevention Actually Overlap
There’s a tendency to treat “AI risk” and “fraud risk” as separate conversations inside an organization one owned by IT, the other by finance. That separation doesn’t hold up anymore. The same AI usage policy conversation that governs whether your engineers can paste drawings into a public chatbot should also address what happens when AI shows up as the attack vector instead of the tool being misused internally. We’ve written before about the exposure created when employees experiment with generative tools without guardrails the shadow AI risk of an engineer pasting a customer drawing into a public model is a different failure mode than a cloned executive voice, but both stem from the same underlying gap: no clear policy about how AI-generated content, in either direction, gets trusted or verified inside the business.
If your organization hasn’t yet formalized guidance here, it’s worth reviewing how to build an AI usage policy that covers both directions of the risk what your employees can safely do with AI tools, and what your finance and operations teams need to verify before trusting AI-mediated communication from anyone claiming to be inside your chain of command. Pairing that with a broader AI readiness assessment gives you a single framework instead of two disconnected policies that neither IT nor finance fully owns.
Training That Doesn’t Rely on Fear
Security awareness training on this topic fails most often when it’s delivered as a single alarming presentation about how scary deepfakes are, with no practical mechanism attached. What actually changes behavior is repetition tied to real workflow: quarterly tabletop exercises where finance and executive assistant staff practice the callback procedure against a simulated urgent request, and short, specific refreshers tied to real incidents rather than generic warnings.
It also helps to be honest with staff about the limits of their own detection ability. Telling someone to “just spot the fake” sets them up to fail, because the tools are good enough now that spotting it by ear or eye alone is a coin flip at best. Telling them instead that their job is to follow the verification procedure regardless of how convincing the request sounds removes the pressure to be a forensic audio analyst and replaces it with a process they can actually execute under stress. A vCIO engagement is a useful structure for this kind of training program, because it puts ownership of the policy and its enforcement with someone who has visibility across both the technical and financial sides of the business, rather than leaving it split between departments that rarely compare notes.
What to Do in the First Ten Minutes After a Suspected Incident
If a request gets flagged as a possible deepfake or impersonation attempt, speed matters more than certainty. The immediate priority is stopping any transaction, credential change, or data transfer already in motion contact your bank directly if a wire has been initiated, and disable or reset any credentials that were shared or changed as part of the interaction. Notify your IT and security team immediately, even if you’re not fully certain the request was fraudulent; a false alarm costs you a few minutes, but a confirmed incident that goes unreported for hours can cost far more, both financially and from a compliance standpoint if CUI was involved.
Document everything about the interaction while it’s fresh the number or platform used, the exact wording of the request, timestamps, and anything that seemed off, even details you can’t fully articulate yet. That documentation matters for law enforcement reporting and, for organizations under a DoD contract, for meeting your reporting obligations. It’s also worth reviewing your backup and recovery posture as part of the response, since a fraud attempt combined with a data exfiltration request is often a precursor to a broader intrusion, not an isolated event. If it turns out backups haven’t been tested against exactly this kind of scenario, our breakdown of immutable backup practices is a reasonable next read.
Reporting resources exist specifically for this. CISA maintains current guidance on emerging threats including AI-enabled social engineering, and its work tracking nation-state cyber activity is directly relevant here, since some of the more sophisticated deepfake-enabled fraud campaigns targeting the defense industrial base have been linked to state-affiliated actors rather than purely financially motivated criminal groups. Contractors working toward certification should also keep an eye on how the DoD CMMC Program continues to evolve its guidance around emerging threat categories, since social engineering and AI-enabled fraud are increasingly part of that conversation rather than a footnote to it.
Conclusion
The uncomfortable truth about AI-enabled impersonation fraud is that it doesn’t target weak technology it targets normal human trust under time pressure, and no firewall fixes that on its own. What actually reduces your exposure is a combination of realistic training, a verification process people will use even when a request sounds urgent and legitimate, and IT infrastructure built with this threat in mind rather than bolted on after an incident. For defense contractors already managing CMMC requirements across engineering, manufacturing, and finance operations out of Boston, Tampa, or Sarasota, this isn’t a separate initiative it belongs inside the same security and compliance program you’re already building.
If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 or visit the website to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.
