Skip to main content
Diopter
Log inBook a demo
Industry

Real-time social engineering defense for enterprises

Diopter helps the people who approve payments, reset access, and support your executives spot a call that isn't what it seems. We test those teams with simulated attacks, then assist them on their own calls with real-time alerts before any money or access changes hands.

Your first agentic attack is on usBook a walkthrough

A free simulated attack on a team you choose, with an NDA first if you want one.

What can Diopter help an enterprise do on calls?

Diopter helps enterprise teams confirm who is calling and checks each payment, reset, or access request before they act.

  1. Hold the wire when the CFO's voice asks for it.

    A cloned CFO might join a video call before the quarter closes and share a new account for a payment.

  2. Stop an MFA reset for the wrong person.

    A "user" with the right employee ID might call the IT help desk and demand a reset within five minutes.

  3. Protect executives and their assistants.

    An attacker could clone the CEO's voice from an earnings call to pressure a direct report or an assistant.

  4. Confirm vendor bank changes by callback.

    A long-standing vendor might ask on a video call to change their bank details and keep the change off email.

  5. Prove your controls to customers, auditors, and insurers.

    If they ask how you verify who is behind a payment, a reset, or an access request, simulation results and the evidence trail from live calls can help you answer.

How does enterprise deepfake detection help stop social engineering on a live call?

Diopter checks four things on every call, across every team an attacker might target.

Identity

Whether the caller and the instruction match your records when someone claims to be the CFO, an employee, or a vendor

Mismatch

Voice and video

Cloned voices on Teams calls and on phone lines into the help desk, plus face-swap and lip-sync artifacts on video, scored for the whole call

Synthetic

Conversation

Pressure such as an "executive" who's boarding in 10 minutes and promises to sign off later

Pattern

Policy

A payment, an access reset, or a vendor change checked against your approval policy for skipped steps

Out of policy

The person on the call sees the real-time alert, the reason, and a suggested next step, such as pausing the request and calling back on a known number. A person decides, and your security team gets the evidence and the transcript.

Which social engineering attacks have hit enterprises?

Enterprises including MGM Resorts, Arup, WPP, and Ferrari have been targeted by help desk calls and cloned executive voices and video. Some of those attacks cost millions.

  1. In September 2023, the group that claimed the MGM Resorts attack said it had found an employee on LinkedIn and then called the company's IT help desk to get into that employee's account. MGM said the attack would cost about US$100 million in its third-quarter results.1

  2. In early 2024, a finance employee at the engineering firm Arup joined a video call with what looked like the CFO and several colleagues, then approved 15 transfers worth about US$25 million. Everyone else on the call was a deepfake.2

  3. Scammers targeting WPP set up a Microsoft Teams meeting through a WhatsApp account that used CEO Mark Read's photo. They used a voice clone built from YouTube footage to ask an agency leader to start a new business, but the attempt failed.3

  4. In July 2024, a Ferrari executive got WhatsApp messages and then a call from a cloned voice of CEO Benedetto Vigna about a confidential deal. When he asked about a book Vigna had recommended days earlier, the caller hung up.4

These attacks follow the same pattern:

  1. The attacker researches public profiles, earnings calls, or a company’s org chart first.

  2. The call comes from a senior name or a known employee, often on a channel that looks routine.

  3. The ask skips a step, such as a new account for the payment, an urgent MFA reset, or "keep it off email."

  4. The attack only stops when someone checks, by asking a question the caller can't answer or calling back on a known number.

Why are enterprises a target for social engineering?

Enterprises have more people who can move money or grant access and more public footage of the executives who sign off on those requests. Staff work across offices and time zones, so a call from a senior name you've never met in person feels normal. The FBI counted US$2.77 billion in business email compromise losses in 2024 and has warned that criminals use AI-generated audio and video on live calls to pass as executives and vendors.5

How do social engineering simulations work for an enterprise?

Diopter runs simulated attacks against your finance, help desk, and executive teams, with a cloned voice or deepfake video if you want it. You see who spotted the attack and at which step, so you can harden both your policies and your people. Do the dry runs with us through social engineering red teaming before a real attacker does.

  1. We'll run simulated calls built from real attacks on finance, the help desk, and executives

  2. You'll receive results by team and by step, so you know which teams to fix first

  3. The same scenarios then become the checks Diopter runs on live calls

How does Diopter roll out for a security team?

Diopter rolls out with a pilot on one team and one platform, usually payments or the help desk, then widens through your MDM once the pilot results are in.
  • OpenTelemetry native: logs flow into your SIEM, and EDR and MDR connect via API
  • Runs on Zoom, Microsoft Teams, Google Meet, and phone lines, with Webex coming soon
  • Captures calls with or without a bot, with nothing to install on the caller's side
  • Rolls out through MDM (Intune, Jamf)
  • Offers configurable data retention, including zero retention, and on-prem or hybrid deployments
  • Has completed a SOC 2 Type II audit

Two ways to start

Your first agentic attack is on us. Fill out the form, and we'll talk through how to run a simulated attack on one of your teams. Want to talk about live-call defense instead? Book a walkthrough, and we'll replay a real deepfake call and show you what Diopter caught and when.

Your first agentic attack is on usBook a walkthrough

Common questions for security and finance teams

Can Diopter test our company with a simulated attack first?

Yes. Diopter will run simulated attacks on your finance, help desk, and executive teams, using a cloned voice or deepfake video if you'd like, and show you where each team caught them. Most teams start there, then turn on the same scenarios for live calls.

How do enterprises stop deepfake and social engineering calls?

Diopter helps your people spot the attack on the call itself. It checks the caller's identity, the voice, the conversation, and whether the request fits your policy on Zoom, Microsoft Teams, Google Meet, and phone lines, then alerts the person on the call before anyone sends money or resets access.

Which teams should enterprise deepfake detection cover first?

Diopter recommends starting with the team that approves the hardest thing to undo, which is usually payments, then access resets. The pilot starts with one team and one platform, then expands from there.

Can one enterprise deepfake detection deployment cover finance, the help desk, and executives?

Yes. Diopter runs as one deployment with one console for your security team. Each team gets the policy that fits its calls, such as approval steps for payments and verification steps for resets.

Does Diopter work on phone calls to the help desk?

Yes. Diopter runs on phone lines and VoIP as well as video calls, so a cloned voice calling your IT help desk gets the same checks as a Teams call.

How does Diopter avoid false alarms on busy calls?

Diopter won't flag a busy executive with a real deadline. One urgent sentence or one glitchy camera isn't enough. Before it alerts, it needs to see the whole pattern, such as claimed authority, pressure, and an ask that skips a step your policy requires.

What should an enterprise look for in social engineering defense?

Start with your own process. A callback on a known number and a second approver for payments, password resets, and vendor bank changes can stop many of these attacks without any tool. When you compare tools, run each one on your own finance, help desk, and executive calls during a pilot and measure how often it raises a false alarm, how fast the alert reaches the person on the call, and what it does with recordings and data. Check that it covers the channels your teams use and fits your existing security tools and rollout process. The final decision should stay with a person. Your own pilot will tell you more than any vendor's benchmark, ours included.

Research behind enterprise deepfake detection

Sources
  1. TechCrunch, Sep 14, 2023, on how the attackers got in; Reuters via Claims Journal, Oct 6, 2023, on the US$100 million cost.
  2. CNN, May 16, 2024, on the Arup deepfake scam.
  3. Storyboard18, May 13, 2024, citing The Guardian, on the WPP attempt.
  4. Fortune, Jul 27, 2024, citing Bloomberg, on the Ferrari attempt.
  5. FBI IC3 2024 Internet Crime Report, and FBI PSA I-120324-PSA, Dec 3, 2024.