AI Voice Cloning Gives Attackers the Early Edge
Former FBI cyber leader Cynthia Kaiser says defenders will catch up over the next few hard years, though attackers lead on AI today.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust that a familiar voice on the phone is really who it claims to be?
Former FBI cyber leader Cynthia Kaiser, who now leads ransomware research at Halcyon, assessed that defenders are still catching up to attackers in their use of AI. The discussion, held on a special joint episode of Ctrl Alt Lead and Ready Set Mid-Market, is analysis rather than a shipped product or new research result.
Why it matters
AI is lowering the cost of convincing phishing and social engineering, which shifts the balance toward attackers for now. Kaiser projects that defenders will close the gap, but describes the next few years as difficult.
The primary figure is that three seconds of audio is enough to clone a voice for voice phishing, a measured capability rather than a projection. The commentary offers no benchmark comparing attacker and defender AI capacity, so the 'a little more' gap remains qualitative.
The players
Cynthia Kaiser
Former FBI cyber leader who now leads ransomware research at Halcyon.
Halcyon
Cybersecurity company whose research group focuses on ransomware threats.
The details
Voice phishing, or vishing, is a scam in which an attacker impersonates a trusted person over the phone, and AI voice cloning makes that impersonation far more believable. Kaiser recommends layered verification, including multi-factor authentication (a login check that requires a second proof of identity, such as a code from a phone), rather than trusting whether a voice sounds familiar. She also notes that small and medium-sized enterprises can serve as entry points, since attackers use them to reach larger organisations through supply chains.
Timeline
Discussion recorded on the joint Ctrl Alt Lead and Ready Set Mid-Market episode, dated 2 November 2026.
The Tech Race
Kaiser's account places the present moment as one where attackers hold an early edge in AI, with defenders expected to close the gap over several years. The source does not identify a competing research program or product milestone against which this positioning can be measured.
Individuals and small organisations are the most immediate audience, since voice cloning can make a phone call from a trusted contact a convincing attack. Kaiser's guidance is to verify requests through several independent checks instead of relying on voice recognition alone.
The takeaway
Do not treat a familiar voice as proof of identity; require a second, independent check before acting on any sensitive request. Watch for the defender-catch-up projection Kaiser describes, which the coming years should either confirm or contradict.
Further reading
For broader context on how these threats are evolving, explore the Cybersecurity section.
Source note: This article includes information reported by Computing.
Live Poll
Do you trust that a familiar voice on the phone is really who it claims to be?
