When Trust Becomes the Attack Surface: Sahaj Gandhi on Voice and Video Phishing

Why the next phishing attack may sound and look like someone you know

For years, phishing was something most employees were taught to recognise in an inbox.

When Trust Becomes the Attack Surface: Sahaj Gandhi on Voice and Video Phishing

A suspicious sender. A strange attachment. A link asking you to reset your password. A message that creates just enough urgency to make you act before you think.

That model is changing.

The next phishing attack may not arrive in an email at all. It may arrive as a phone call from someone who sounds exactly like your boss. It may be a video meeting with a familiar face. It may be a voice note from a vendor who knows the project, the people involved and the reason a payment is supposedly urgent.

The target, in such a case, is no longer the inbox.

It is trust.

This is the problem at the centre of the work of AI engineer Sahaj Gandhi. His career has spanned computer vision, autonomous systems, enterprise AI and cybersecurity, and his current work at DeepTrust focuses on building real-time AI systems for detecting deepfakes, social-engineering attempts and other threats during voice and video communications.

What connects these seemingly different areas is a fairly simple idea: machines often have to make decisions when the available information is incomplete, noisy and changing.

That problem becomes particularly difficult when a human decision is part of the system.

Cybersecurity has always had a human problem. Generative AI is making that problem considerably harder.

“Traditional phishing tried to make you click something. Voice and video phishing try to make you believe someone.”

That distinction matters.

A malicious email can be quarantined. A suspicious attachment can be scanned. A compromised endpoint can trigger an alert.

But a conversation happens in real time.

Someone calls an employee and says there is an urgent payment issue. A senior executive appears on a video call and asks for confidential information. A supplier asks for bank details to be changed. An employee receives a call from what appears to be the IT help desk asking for a password reset.

The employee is not merely processing information.

They are making a decision under pressure.

The MGM Resorts cyberattack in 2023 remains a useful example of how powerful that human layer can be. MGM disclosed an estimated negative impact of about $100 million on adjusted property EBITDAR following the incident. Reporting on the attack pointed to social engineering of the company’s help desk as an important part of the initial compromise.

The lesson from such incidents is uncomfortable: an organisation can spend heavily on firewalls, endpoint protection and identity systems and still be vulnerable to a conversation.

Generative AI potentially makes that conversation much more convincing.

Voice cloning no longer requires a particularly sophisticated attacker. Synthetic video can make a remote meeting appear authentic. An attacker can prepare a script using information available from company websites, social media, previous communications and public records.

The individual attack may still be technically simple.

What changes is the credibility of the story around it.

And this is where Gandhi’s argument moves beyond the familiar debate about deepfakes.

“A lot of people still think of deepfakes as fake videos on the internet. But in the enterprise, the more dangerous version is someone trying to get a person to approve something, reveal something, reset something, or transfer something.”

In other words, the question is no longer simply whether a piece of audio or video is synthetic.

The more important question is whether the interaction itself is safe.

That is a considerably harder problem.

Consider an employee receiving a call supposedly from a senior executive. The voice is familiar. The request is plausible. The caller knows the names of colleagues and refers to an actual transaction. The employee has five minutes to respond.

There may be no obvious technical warning.

The attack succeeds because the attacker has controlled the context.

This is why one of Gandhi’s recurring ideas is particularly relevant: security systems need to slow down the moment.

Attackers create urgency because urgency reduces verification. Asking questions begins to feel like resistance. Calling someone back seems inconvenient. Requesting a second approval appears bureaucratic.

The attacker wants the employee to think: I know who this is. I don’t want to waste their time.

A good security system should make the opposite response normal.

If a request involves money, credentials, privileged access or sensitive information, the system should increase the level of verification. It could ask the employee to confirm through an established channel, require another approver, or recommend calling back using a number already stored in the company’s system.

The important point is that the technology should not simply shout “DEEPFAKE DETECTED.”

It should help a person decide what to do next.

“In sensitive situations, AI should not just say yes or no. It should explain why something may be risky and what the person should verify next.”

That is a more useful way to think about AI in security.

There is a temptation in the technology industry to reduce the problem to detection accuracy. Can the system identify a synthetic voice? Can it detect a manipulated face? Can it distinguish genuine video from generated video?

Those are important questions, but they are not sufficient.

Audio can be compressed. Video can be degraded. Metadata can be missing. Detection models can make mistakes. Attackers can change techniques once they understand what a security system is looking for.

A serious enterprise system therefore has to look at more than the media itself.

Who is making the request? From which device? Through which channel? Is this normal behaviour for this person? Does the request fit the workflow? Has the bank account changed? Is the employee being asked to bypass an established process? How sensitive is the requested action?

The signal is not one thing.

It is the combination.

What makes Gandhi’s background particularly relevant to this problem is that his work has repeatedly placed AI systems in environments where incomplete technical signals have to support consequential real-world decisions.

At Waymo, his work in computer vision and imaging involved systems that had to interpret the physical world under changing lighting, weather and operating conditions. Autonomous systems cannot depend on a single perfect signal. They have to combine information, account for uncertainty and remain reliable when conditions are difficult.

At Uno.AI, Gandhi worked on enterprise AI systems involving document intelligence, contextual retrieval and evidence-grounded reasoning, where useful answers depended on connecting information distributed across different sources rather than treating documents or data points in isolation.

At Octane Security, he helped develop AI systems for smart-contract vulnerability detection. There, the challenge was not merely finding possible issues. Security systems also had to reduce noise, distinguish duplicate or low-value findings from meaningful vulnerabilities and provide enough context for engineers to determine what actually required action.

Across those roles, a consistent technical pattern emerges in Gandhi’s work: turning fragmented, noisy and fast-moving signals into information that can support a reliable decision.

At DeepTrust, that same challenge now applies to live communication.

Instead of relying on a single audio or video signal, the goal is to evaluate multiple indicators together and provide useful context when an interaction appears risky.

There is an important lesson here for companies adopting AI.

The answer to AI-enabled attacks cannot simply be another AI model.

The security architecture has to include processes, people and technology.

Employees must have the authority to pause suspicious requests. Help desks must have stronger identity-verification procedures. Financial workflows should require independent confirmation when risk is high. Executives should understand that their voice and image can now be reproduced.

And organisations should stop treating communication channels as inherently trustworthy.

The traditional security perimeter was a network.

Then it became the endpoint.

Now it may be the conversation.

That does not mean every Zoom call should become a forensic investigation. Nor should employees be trained to distrust every familiar voice. That would make organisations impossible to operate.

The challenge is more subtle: trust should be proportional to the consequence of the action.

A casual conversation requires one level of assurance. A request to transfer ₹50 lakh, reset an administrator account or release confidential information requires another.

The technology should help employees recognise that difference without turning every decision into a security procedure.

There is another reason this matters.

As synthetic media becomes better, the old advice to “look for signs that the video is fake” will become increasingly unreliable.

The strange eyes, unnatural expressions and robotic voices that once gave deepfakes away are not a sustainable security strategy.

The stronger defence is procedural rather than visual.

Don’t ask only: Does this look real?

Ask: Does this request make sense?

Is this person authorised to make it?

Is this the normal channel?

Can I independently verify it?

What happens if I am wrong?

Those questions remain useful even when the technology behind the deception improves.

Gandhi’s own description of the challenge gets to the heart of it:

“The hard part is not just building a detector. The hard part is building a decision support system people can trust, one that works in real time, fits into enterprise workflows, and handles uncertainty responsibly.”

That philosophy is also reflected in Gandhi’s current work at DeepTrust, where he is helping develop systems that combine deepfake detection with contextual signals and real-time guidance rather than treating media authenticity as a simple yes-or-no classification problem.

That may ultimately be the more important conversation around deepfake technology.

The industry has spent considerable effort trying to determine whether media is real or fake. Enterprises now have to confront a different question: what should a person do when they cannot be completely certain?

That is not merely an AI problem.

It is a management problem, a security problem and, ultimately, a human decision-making problem.

The next generation of phishing may therefore look surprisingly ordinary.

A familiar face.

A familiar voice.

A familiar request.

And perhaps the most dangerous sentence in the conversation will be:

“You know me. You can trust me.”

That is precisely when the security system should help the employee pause.

Because in the age of generative AI, the thing being attacked may no longer be the computer.

It may be the reason we trust the person sitting on the other side of the screen.

Note to readers: This article is part of HT's paid consumer connect initiative and is independently created by the brand. HT assumes no editorial responsibility for the content, including its accuracy, completeness, or any errors or omissions. Readers are advised to verify all information independently.