How is Diopter deployed?

Native desktop and Android apps, MDM rollout for fleets, an MCP server for agent integrations, and a Communication Filtering API for inline VoIP and conferencing trunks. Most teams pilot on the desktop app and roll wider through MDM.

On-device by default, with support for inline APIs and MCP-based integrations.

How do you handle call data?

Call media is processed through Diopter’s detection engine as part of real-time scoring across voice and video channels.

What's the latency overhead on a live call?

Continuous multimodal scoring is designed to run in real time across live calls.

How are false positives handled?

Verdicts are structured across multiple risk levels including Verified, Possible Impersonation, Suspected Threat, and High-Risk Threat, enabling graded responses such as Allow, Flag for review, Hold for verification, or Block.

One detection engine. Every channel your team takes a call on.

Diopter rides alongside the video and voice tools you already use (Teams, Zoom, Meet, and the major VoIP providers) and reaches your fleet through native apps, MDM, MCP, and an inline filtering API.

Works with · video

Works with · voice

See a real attack arc See the detection engine

Detection engine

Two axes. One verdict. Live.

Most products score one signal in isolation. Diopter combines live multimodal AI detection with conversation arc modeling, then collapses both into a single verdict and recommended action before the irreversible ask.

Inputs

Video frames
Voice stream
Dialogue
Context

AI Detection

Multimodal classifiers score whether the media you're seeing and hearing is real or synthetic, continuously across the call rather than on a single frame.

Synthetic voice
Deepfake video
Liveness & artifact signals

Conversation Arc

The arc model watches how a conversation is shaped: who's being positioned as authority, what's being asked for, and whether the trajectory is moving toward an irreversible action.

Authority framing
Pressure & urgency
Trajectory toward the ask
Out-of-policy outcomes

Output

Verdict

Verified
Possible Impersonation
Suspected Threat
High-Risk Threat

Action

Allow
Flag for review
Hold for verification
Block

See matrix

RuntimeContinuous multimodal scoring·on-device by default·verdicts as headers, webhooks, MCP tools

Channels covered

Video CallLive

Zoom, Teams, Google Meet, Webex. Native app sits beside the conferencing client and scores every participant.

VoIP / VoiceLive

Inbound and outbound calls across softphone and desk handsets. Inline at the trunk via Communication Filtering API.

Note

Email, SMS, and LinkedIn signals feed Diopter's cross-channel correlation engine (even where Diopter doesn't terminate the channel) so a vishing call can be linked to the spear-phish that preceded it. See how this plays out across specific industries.

Arc reconstruction

Authority → Urgency → Isolation → Escalation → Ask.

The arc is the playbook. Each move leaves signals; the model scores them in order and intervenes before the ask.

T-7d → T-1h

Authority

Attacker establishes role: cloned exec, vendor, recruiter. Diopter scores claimed identity vs. enrolled biometric.

T-00:00

Urgency

Time pressure compresses verification. Diopter detects rushed openings and out-of-policy timing.

T+02:00

Isolation

Channel narrowed, witnesses removed. Diopter watches for off-domain handoffs and DM-only requests.

T+06:00

Escalation

Stakes raised: threats, secrecy framing. Diopter scores semantic pressure and authority claims.

T+11:48

Ask

Wire, MFA reset, credentials, hire. Diopter blocks before the irreversible action.

Verdict matrix

From two axes to a single verdict.

Two independent signals (is the media real, and is the conversation pushing toward an irreversible action) combine into one verdict and one recommended action. Neither axis alone is enough; the matrix is how we avoid both false alarms and missed threats.

Verdict matrix · ai detection × arc4 verdict classes

Axis 01 · AI Detection

Are the voice and video frames synthetic, or a real human?

Axis 02 · Conversation Arc

Is the dialogue being shaped toward authority, urgency, isolation, and an irreversible ask?

AI Detection	Arc Risk	What this looks like on a call	Verdict	Recommended action
Clean	Low	Real human on the line, request flow looks normal. No synthetic media, no pressure pattern.	Verified	Allow
Clean	High	Real human voice, but the conversation is being shaped toward an irreversible ask through urgency, authority framing, and off-policy timing. A social-engineering attempt by a real person, or a coached insider.	Potential Threat	Flag for review
Synthetic	Low	Synthetic voice or deepfake video detected, but the conversation isn't pushing toward a high-risk action. Often a benign AI agent, voice filter, or early-stage probe.	Suspected Threat	Hold for verification
Synthetic	High	Synthetic media plus the arc is closing on a wire, MFA reset, credential hand-off, or hire. Both axes confirm.	High-Risk Threat	Block

Delivery surfaces

Meet your team where the calls happen.

Native Apps

Desktop (macOS, Windows) and Android. Sits next to Zoom, Teams, Meet, dialer.

MDM Rollout

Push to a fleet via Jamf, Intune, Kandji, or your MSP's RMM.

MCP Server

Drop into agent stacks. Verdicts available to copilots and agents.

Filtering API

Inline on VoIP and conferencing trunks. Verdicts back as headers/webhooks.

For your team

Built for the people who own the call.

Security, IT, and partner teams each get the surface area they need: policy depth for CISOs, fleet rollout for mid-market IT, and multi-tenant operations for MSPs.

For CISOs

Policy-graded, on-device by default.

Detection runs on the endpoint so call media doesn't leave your perimeter. Verdicts are graded so you can alert on Suspected and block on High-Risk only. SOC 2 in progress, DPA on request.

Security & data handling

For mid-market IT

Push to the fleet in a week.

Native desktop and Android apps, deployed via Jamf, Intune, or Kandji. Pilot group on day one, full fleet by end of week. No call recording, no trunk reconfiguration required.

How it deploys

For MSPs

Multi-tenant from a single console.

Deploy across customer tenants from one pane. Per-tenant policy, reporting, and incident review. Verdicts available via API and MCP for your existing SOC and ticketing workflows.

Talk to partnerships

Comparison

Where the arc changes the math.

Most categories cover one signal or one channel. The arc model and live multimodal coverage are where Diopter sits alone, and where partial overlaps still leave the irreversible action unprotected.

Capability	Awareness training	Single-frame deepfake	Identity / reputation	Live-call detection	Diopter Arc
Detects synthetic voice on a live call
Detects deepfake video frames
Verifies caller identity (reputation/biometric)
Models the conversation arc (pressure → ask)
Cross-channel correlation (video, voice, +)
Forensic evidence chain for incident review

Supported Partial Not supported

FAQ

Questions, answered.

Still have questions? Walk an arc with our team

Walkthrough · 30 min · NDA-safe

Walk an attack arc with our threat team.

We'll replay a real deepfake incident through Diopter, frame by frame and signal by signal, and show what you would have caught and when.

See a real attack arc Read the research