The Voices in the Wires: Why Deepfakes Just Broke Your ISO 27001 Certification 

The Burned Playbook 

It’s 4:00 PM on a Friday. The office is thinning out, inboxes are being cleared, and decisions are being rushed before the weekend. The Finance Director joins a Microsoft Teams call. The CEO is already there, calm, focused, slightly impatient. The video is crystal clear. The voice carries the exact cadence they’ve heard in board meetings for years. 

“We need to move quickly,” the CEO says. “£250,000. Vendor payment. It closes the acquisition today.” 

There’s urgency, but nothing unusual. Deals move fast. The Finance Director processes the payment. 

By 6:30 PM, the real CEO is still in the air, halfway to Munich, completely offline. 

The call never happened. The face, the voice, the mannerisms, all synthetic. Built from publicly available footage, stitched together by generative AI, and deployed with precision. No malware. No suspicious link. No firewall alert. 

Just a conversation. 

This is the moment most organisations are unprepared for. Not because they lack controls, but because their controls are pointed at the wrong threat model. Your Information Security Management System, as it stands, is likely blind to this. 

ISO 27001 Clause 7.3 ‘Awareness’ was designed for a world of crude phishing emails and obvious deception. A world where “spot the mistake” was a viable defence strategy. That world no longer exists. 

If your awareness training still teaches employees to look for poor grammar or suspicious URLs, you are not managing risk, you are performing it. 

Deepfake driven social engineering doesn’t break your systems. It walks straight through them.

Would you like recommendations from our experts? Get a free quote and consultation on the introductory phone call!

Why Clause 7.3 is Currently a Liability 

Most organisations treat awareness training as a compliance exercise. Quarterly phishing simulations. A report on click rates. Maybe a follow up module for those who fail. 

On paper, it satisfies Clause 7.3. In reality, it is equivalent to training soldiers to use muskets while the battlefield has shifted to autonomous drones. 

Click rate metrics are the clearest example of this illusion. They provide a sense of control, numbers that can be tracked, improved, and presented during audits. But they measure resistance to a threat that is rapidly becoming obsolete. 

Deepfake attacks do not rely on links. They do not require payloads. They do not need victims to click anything. They rely on something far more reliable, human psychology. Authority. Urgency. Context. 

When a senior executive appears, visually and audibly authentic, and delivers a time sensitive instruction, the brain defaults to compliance. This is not a failure of training, it is a feature of how humans operate in hierarchical environments. 

Traditional awareness programmes assume that threats look suspicious. 

Deepfakes are effective precisely because they do not. 

There is also an uncomfortable truth regarding audits. Many auditors will still accept basic phishing simulations as sufficient evidence of awareness. The control is technically satisfied. But compliance is not security. If your ISMS is built to pass audits rather than withstand attacks, you are optimising for the wrong outcome. 

The gap between auditable and effective has never been wider.

Unsure where to start in bringing you ISO 27001 system up to date? Chat with us for a quick advice!

Anatomy of a Deepfake Hijack

To defend against deepfake attacks, you need to understand a critical point. They do not resemble attacks. They resemble normal business operations. 

Step 1: Context Harvesting, the digital stalking

Attackers are not breaching your perimeter, they are observing your organisation in plain sight. They analyse executive interviews, earnings calls, webinars, and social media content. They map organisational hierarchies through LinkedIn. They identify who reports to whom, who authorises payments, and who operates under pressure. 

This is not hacking. It is intelligence gathering. 

By the time the attack begins, the attacker understands your internal dynamics better than some of your own employees. 

Step 2: The Soft Entry

The initial contact is deliberately unremarkable. A short email. A WhatsApp message. Maybe a casual introduction referencing a legitimate business context. No links. No attachments. No red flags. 

The objective is not immediate compromise, it is channel establishment. 

Once the communication pathway feels normal, the attacker escalates. 

Step 3: The Synthesised Strike

This is where the deepfake is deployed. A voice note. A phone call. A video meeting. 

The quality does not need to be perfect. In fact, slight imperfections can increase credibility. People expect minor glitches in calls. Compression artefacts, background noise, and poor lighting all work in the attacker’s favour. 

The instruction is delivered with precision, urgent, plausible, and aligned with existing business activity. At this point, the employee is not evaluating authenticity, they are executing a task. 

The takeaway?

This is not a single channel attack. It is multimodal, moving fluidly between email, messaging platforms, voice, and video. Most ISO 27001 awareness programmes treat these channels independently. Email phishing is tested. Maybe password hygiene is covered. 

But the real threat operates across channels, blending them into a seamless narrative. Your controls are siloed. The attack is not. 

The Guide for Rewriting Annex A

If the threat has evolved, your controls must follow. This is not about adding complexity, it is about removing reliance on human judgement where it is most vulnerable. 

Filter 1: The Zero Trust Policy, Annex A.5 Organisational Controls 

The core principle is simple. Trust is not a control. Policies must eliminate discretionary decision making in high risk scenarios. 

Action:

• Implement mandatory out of band verification for critical actions. 
• Any financial transfer, supplier change, or credential reset above a defined threshold must be verified through a secondary channel. Not a reply to the same message. Not the same call. 
• A separate, pre verified communication method, such as a known mobile number or internal directory contact. 

If the CEO requests a payment via video, the policy requires the employee to independently verify it via a different channel. 

No exceptions. No judgement calls. 

Filter 2: Overhauling Clause 7.3 Awareness and Training 

The objective of awareness training must shift from detection to behaviour. Stop teaching employees to identify technical anomalies. They will not reliably detect them. Instead, train them to recognise psychological triggers: Urgency. Authority. Secrecy. Deviation from standard process. 

Action:

• Deploy multimodal simulations. 
• Test employees with synthetic voicemails, staged phone calls, and cross channel scenarios, not just emails. 
• Measure how they respond to pressure, not just whether they click links. 
• Train for hesitation. Train for escalation. 

Filter 3: The Digital Drawbridge, Annex A.8 Technological Controls 

Assume compromise at the human level. Design systems that remain secure even when credentials are exposed. 

Action:

• Implement zero trust architecture principles. 
• Enforce device based authentication. Restrict access based on device posture, location, and behavioural patterns. 
• If an attacker obtains valid credentials through a deepfake, the system should still reject access from an unrecognised device or anomalous environment. 
• Layer controls so that no single point of failure, especially a human one, can lead to a full compromise. 

The New Metrics of Paranoia 

If click rates are obsolete, what replaces them?

You still need measurable outputs for management reviews under Clause 9.3. But the metrics must reflect real world resilience. 

Time to Report, TTR

This becomes your primary indicator. 

How quickly does an employee flag something that feels off. Not definitively malicious, just inconsistent or unusual. 

Speed matters more than certainty. 

Verification Behaviour

Track how often employees follow secondary verification protocols. 

Are they using the processes you have implemented. Are they bypassing them under pressure. 

This is a direct measure of behavioural compliance. 

The goal is not to create a workforce of analysts. It is to create a workforce that pauses. That questions. That verifies. 

You are engineering reflexes, not expertise. 

Conclusion: Secure the Human Firewall 

Deepfakes have fundamentally altered the threat landscape. The line between real and artificial is no longer visible to the human eye or ear. 

This is not a temporary shift, it is a permanent one. 

ISO 27001 remains a powerful framework, but frameworks are only as effective as their implementation. If your controls are built around outdated assumptions, they will fail under modern conditions. 

The risk is not theoretical. It is operational. Businesses that fail to adapt their ISMS to AI driven social engineering are not secure, they are exposed. 

The response is not optional. 

• Tear up your outdated awareness training. 
• Audit your financial approval workflows. 
• Remove reliance on instinct. 

Trust nothing. Verify everything. Get Advice:

About Us 

Candy Management Consultants has guided UK businesses through stress-free ISO certifications since 2017. Our 100% first-pass success rate comes from tailoring frameworks to your operations and personalised approach – not checklists, at fixed day rates, transparent per-project contracts and with the help of the modern ISO management software.