Neural Defend
Start Here

Enterprise NeuroVerify · NeuroDetect · NeuroCall (Beta)

Any face or voice that can move money or grant access can now be generated.

Attackers now clone the executive who approves the payment, the employee who calls the help desk and the candidate who joins on video. Neural Defend checks the face, voice or recording behind the request, so a payment, reset or hire waits for a person when the media is not real.

See where it hitsTest it on your own workflow

The problem, in numbers

Police, the FBI and the Justice Department describe the same attack: a trusted face on a remote channel.

  • HK$200m

    moved in 15 transfers by a finance employee after a video conference in which every other participant was a deepfake built from public video. Arup later confirmed fake voices and images were used against it.

    Hong Kong Police via HKFP, 5 Feb 2024
  • $3.05bn

    in business email compromise losses reported to the FBI for 2025. IC3 counts phone calls and virtual meeting apps as BEC channels. Over $30m of it involved AI.

    FBI IC3, 2025 Annual Report
  • 100+

    US companies, many in the Fortune 500, hired North Korean IT workers using stolen and fake identities. One scheme used more than 80 stolen American identities.

    US Department of Justice, 30 Jun 2025
  • 30%

    of enterprises would stop treating face-based identity verification as reliable on its own by 2026 because of deepfakes, Gartner predicted. Injection attacks rose 200% in 2023.

    Gartner, 1 Feb 2024

Where deepfakes hit the enterprise

Six requests your staff approve on a face or a voice.

Each one ends with a person doing something irreversible because someone they trust appeared to ask: a transfer, a reset, a hire, a changed bank account, a published response.

  • The “CFO” on the video call

    Treasury and finance teams

    An email asks for a confidential transfer. A video conference follows, with the CFO and colleagues rebuilt from public video. In Hong Kong, police said the fakes were pre-recorded and the employee was the only real person present.

    NeuroVerifyNeuroDetect

    Check the recorded clip or voice before release. Investigate the full recording in NeuroDetect.

    High-value payment approval

  • The help-desk reset

    IT service desk

    A caller claims to be an employee with a lost phone and asks for a password reset or a new MFA device. CISA and the FBI describe Scattered Spider doing exactly this. A cloned voice removes the last thing that sounded wrong.

    NeuroVerifyNeuroCall (Beta)

    Score a selfie video or voice sample before the reset. NeuroCall analyses the live call.

    Help-desk recovery guide

  • The candidate who isn’t

    Talent acquisition and HR

    A real, stolen identity passes the background check. A different face sits behind a face swap on the video interview. The FBI reports North Korean IT workers using AI and face-swapping in interviews to get hired and paid.

    NeuroVerify

    Check the interview video and the onboarding selfie. Check again when the laptop ships.

    Remote hiring controls

  • The supplier’s new bank account

    Accounts payable

    A letter on supplier letterhead announces new bank details. The call to confirm reaches the number printed on that letter, where a cloned voice answers. The next genuine invoice is paid to the attacker.

    NeuroCall (Beta)NeuroDetect

    Analyse the confirmation call. Examine the letter or supporting document for edits.

    Vendor bank-detail changes

  • The executive voice note

    Executive assistants and chiefs of staff

    A short voice message on WhatsApp or Signal, in the executive’s voice, asks for a document, a code or a quick payment. The FBI warns that AI-generated voice messages impersonating senior officials have been used since April 2025.

    NeuroVerifyNeuroDetect

    Send the audio file for a score. Keep the forensic report if it becomes an incident.

    Executive impersonation

  • The fabricated statement

    Communications, legal and security

    A video of the CEO announcing a recall, or an audio clip of a director discussing results, circulates before markets open. The NSA, FBI and CISA list brand manipulation through executive deepfakes among the top risks to organisations.

    NeuroDetect

    Open the file in a case workspace and attach the forensic report to the response.

    Media investigation

Why your controls pass it

Every control checks the channel or the identity. None checks the face or voice.

The attacker does not break these controls. They route around them, onto the one channel where a familiar face is treated as proof.

ControlThe question it answersWhat gets through

Email security

Is this message spoofed or from a lookalike domain?

The request that moves to a video call, a voice note or a phone line. Mail from a real, compromised mailbox.

Recognising the person

Do I know this face and voice?

A deepfake built from public video of exactly that person. In Hong Kong, the employee recognised his colleagues.

Help-desk knowledge checks

Does the caller know the employee ID, manager and start date?

Details already sitting in breaches, org charts and LinkedIn.

MFA

Is the login coming from an enrolled device?

The device the help desk just enrolled for the attacker. Every login after the reset looks legitimate.

Background and ID document checks

Is this identity real and clean?

A real, stolen identity with someone else’s face on the interview call.

Call-back

Does the known person confirm the request?

Little, if the number was on file before the request. Everything, if the number came from the request itself.

NeuroVerify

Is this face or voice real?

One risk score with six signals, including face manipulation and AI generative model analysis, on the clip, selfie or voice sample.

NeuroCall (Beta)

Is the voice on this call synthetic?

A signal during the live call, for the agent or the payment team.

NeuroDetect

Was this recording or document edited or generated?

Region, frame and audio-segment findings with a forensic report for the incident file.

For the product rows, the last column is what the check adds.

One request, four channels

The fraud is spread across channels. The check follows the media.

Email security sees the email. Payment controls see the account. The video and the voice note are what convinced the employee, and they are the pieces NeuroVerify scores before anyone releases the money.

Payment releaseUrgent transfer · requested by “the CFO”
  1. Email

    “Confidential acquisition. Keep this between us until it is announced.”

    Your email security
  2. Video call

    “CFO” and two colleagues confirm the transfer on camera.

    NeuroVerify · recorded clip
  3. Voice note

    “Send it today. I’ll sign the paperwork on Monday.”

    NeuroVerify · audio file
  4. Payment

    New beneficiary account. First payment. Same-day release.

    Your payment controls
  1. 1
    Face manipulation signals

    On the “CFO” in the call recording.

    NeuroVerify
  2. 2
    Synthetic speech signals

    Across the voice note.

    NeuroVerify
  3. 3
    Policy exception

    New account, secrecy, same-day release.

    Your payment rules
RouteRelease paymentHold · call the CFO on the directory number

Guidance for enterprises

Security agencies already name these workflows.

None of this guidance names a product or makes detection mandatory. It tells you where the attacks land and what to verify.

  • NSA, FBI and CISA

    Contextualizing Deepfake Threats to Organizations, Sep 2023

    Names executive impersonation for financial gain, and impersonation to gain access, including remote job interviews, among the main deepfake risks. Recommends real-time verification, passive detection and protecting the communications of senior officers.

    Read it
  • CISA and FBI

    Advisory AA23-320A, Scattered Spider, updated Jul 2025

    Documents attackers calling IT help desks to reset passwords and transfer MFA tokens, and posing as IT staff to collect one-time codes.

    Read it
  • FBI

    PSA I-012325, North Korean IT workers, Jan 2025

    Reports AI and face-swapping in video job interviews. Advises identity verification during interviewing, onboarding and throughout employment, and in-person steps where possible.

    Read it
  • FBI

    PSA I-051525, senior official impersonation, May 2025

    Warns of AI-generated voice messages impersonating senior officials: a message claiming to come from one should not be assumed authentic.

    Read it

Deployment

One API for the help desk and hiring. A workspace for security.

Help desk

NeuroVerify is called from your reset flow before a password or MFA change. REST, Python, TypeScript, Go and Java.

Hiring

NeuroVerify on interview video and the onboarding selfie. Native SDKs for Android, iOS and Flutter where candidates capture on a phone.

Finance

NeuroVerify on clips and voice notes behind a payment request. NeuroCall (Beta) on confirmation calls, under evaluation.

Security and investigations

NeuroDetect as a web app, in your VPC, as a secure container, on-premises or air-gapped.

NeuroVerify takes two lines to integrate and can be live in under 24 hours. ISO/IEC 27001 · 27701 · 42001 · SOC 2 Type II. Sign in · Deployment options · Trust centre

Knowledge centre

Read next, by workflow.

View all insights

Sources

Read the evidence yourself.

Third-party publications. None of them evaluates or endorses Neural Defend.

Can you stop a deepfake in a live Teams or Zoom meeting?

Not as a live meeting product today. NeuroVerify scores a recorded clip or captured frame, and NeuroDetect examines a full recording in an investigation. For live voice calls, NeuroCall is in Beta. The control that stops a live meeting fraud is a call-back on a number you held before the request arrived.

Where does NeuroVerify sit in a help-desk reset?

Before the password or MFA change. The employee records a short selfie video or voice sample; your reset flow sends it in one API call and reads back one risk score with the signal evidence. Your policy decides whether the reset goes ahead, steps up or goes to a manager. How help-desk impersonation works

Does it replace background checks in hiring?

No. Background checks confirm the identity is real. NeuroVerify checks whether the face and voice on the interview are real. It does not analyse ID documents, so keep your document checks in place. Employee background verification

Will employees and candidates notice the check?

Rarely. NeuroVerify returns eligible image requests in under 200 ms at p95 under defined test conditions, and your rules decide which resets, interviews or payments get checked.

Is NeuroCall ready for production?

NeuroCall is in Beta. Run it on a defined set of calls during an evaluation and decide from the results. NeuroVerify and NeuroDetect are live. About the Beta

Where does our media go?

Your choice: managed cloud, your own VPC, a secure container, on-premises or air-gapped. Neural Defend holds ISO/IEC 27001, 27701 and 42001 certifications and a SOC 2 Type II report. Product data handling

Test it on your own media

Pick the reset, hire or payment you worry about most.

Bring help-desk recordings, interview clips and voice notes, including ones you know were fake. See what NeuroVerify scores, what NeuroDetect finds and where each result would route in your workflow.

Book an evaluationExplore NeuroVerifyExplore NeuroDetect