“Many deepfake phishing campaigns are fueled by targeting information obtained from compromised accounts,” says Jim Richberg, head of cyber policy and global field CISO at Fortinet. “That connection makes the outreach seem legitimate.”
For SMBs, where IT teams are often small and employees wear multiple hats, that credibility can make it even harder to distinguish real requests from malicious ones.
That’s why foundational user training remains one of the most cost-effective defenses. Even as technology evolves, teaching employees to recognize classic phishing signals — urgency, unusual requests or changes in normal processes — can significantly reduce risk.
A Practical, Multilayered Security Approach for SMBs
Traditional email filters and text-based protections are no longer enough — especially for organizations with limited security layers.
AI-powered impersonation can now support real-time conversations, answering personal verification questions and mimicking trusted individuals. This makes it easier for attackers to bypass help desks or trick employees into approving payments or sharing credentials.
For SMB IT leaders, the goal isn’t to replicate enterprise-scale defenses but to build a rightsized, multilayered strategy that combines:
- User awareness training
- Simple process controls
- Targeted security tools
For example, one of the most effective changes is also one of the simplest: slowing down.
“Users are more likely to fall for scams on mobile devices,” Richberg explains. Encouraging employees to review financial or sensitive requests on a full-sized screen — where they can inspect links and verify details — adds an extra layer of protection.
SMBs can also reduce risk by introducing lightweight process controls, such as:
- Requiring a second approver for financial transactions
- Verifying requests through a separate communication channel (such as a phone call)
- Standardizing procedures for password resets or account changes
These steps don’t require major investments, but they can dramatically reduce exposure.
WATCH: Get the four cybersecurity trends impacting businesses in 2026.
Rethinking Authentication in the Age of AI
As deepfake audio improves, even voice-based authentication may become less reliable. Organizations that rely on biometric verification should monitor evolving threats and be prepared to adapt.
For SMBs, this doesn’t necessarily mean replacing systems immediately. Instead, it means:
- Staying informed about emerging risks
- Layering authentication methods (such as multifactor authentication)
- Periodically reviewing security policies
“This will require organizations to monitor emerging threat capabilities and upgrade their security practices,” Richberg says.
