What happens to identity security when an attacker can copy an executive's voice, face, and employment history using inexpensive tools? In this episode of The Business of Cybersecurity, I speak with Bojan Simic, CEO and co-founder of HYPR, about the effect of generative AI on impersonation, credential recovery, and help desk security. HYPR is a New York cybersecurity company focused on identity-based attacks. Bojan says identity-related events account for between 60 and 80 percent of incidents, depending on the security report being used, and his team helps organizations find and repair weak points across the identity chain. The demonstration during our conversation makes the risk unusually tangible. Bojan changes his on-screen face into mine using software running on his local computer. The result is not flawless, but it is convincing enough to show why a familiar face on a video call can no longer be accepted as evidence by itself. With additional preparation, an attacker can also clone a voice, gather employment details from public profiles, and automate much of the reconnaissance that previously required repeated manual calls. Bojan argues that asking employees to recognize every deepfake repeats an old cybersecurity mistake. Phishing simulations showed how quickly people return to normal working habits after training. Help desk staff are trying to resolve problems, support colleagues, and close tickets. They should not be expected to determine whether a distressed caller, senior executive, or remote employee has been digitally recreated. One hospital example illustrates the weakness of knowledge-based checks. According to Bojan, an attacker called the help desk while pretending to be a doctor but did not know the required four-digit PIN. The attacker then called the doctor while posing as the IT team, obtained the PIN, returned to the help desk, and gained access to the account. The process technically followed policy, yet the policy relied on information that could be socially engineered. We discuss how the same attack can become faster through AI. A system can call the help desk, discover which questions are asked, search public sources for the answers, call the employee when information remains missing, and return with the required details. Requiring video does not solve the problem when faces can also be recreated. The conversation also covers continuous identity proofing. Instead of treating verification as an event completed during onboarding, companies can request stronger evidence when behavior changes. A new device, unfamiliar operating system, first-time access to a sensitive application, return from a long absence, or promotion into privileged access can all justify another check. Routine work from a known device should remain straightforward, allowing friction to appear when the risk changes rather than during every action. Privacy deserves equal attention. Bojan acknowledges that employees in some countries may resist location, document, or biometric checks. His recommendation is to explain what is collected, whether it is retained, and what alternatives exist. An employee who declines remote verification can be offered an in-person process. That gives people a choice while preserving the security requirement. The most immediate action is to test password recovery and credential reset. Bojan advises moving those functions away from phone-based help desks and into a self-service process that combines device, location, or document verification. He says credential resets account for roughly 30 to 40 percent of help desk calls, so the change may also reduce support demand. Could a cloned executive, remote worker, or doctor pass your current recovery checks, and which independent signal would stop them? Listen to the episode and share your thoughts with me.
