Pindrop Shifts to Agent Verification as Voice Deepfakes Target Banks

Agentic Product Safety from Pindrop | Nicholas Holland from Pindrop — @Scale

@Scale

Enterprises must abandon blanket bot bans and replace obsolete knowledge-based phone authentication with real-time synthetic governance as conversational AI renders traditional identity checks useless.

AI-assisted summary of Agentic Product Safety from Pindrop | Nicholas Holland from Pindrop — original source. Check the original for full context.

Source published:

Key ideas

  • Pindrop projects 1 trillion autonomous agents will operate globally by 2035 (roughly 100 per human), with enterprise inbound phone traffic already showing 94% benign automated callers and an alarming 6% malicious bot share. (0:05)
  • Adversarial reconnaissance bots leverage dark web PII and conversational voice models to systematically map IVR trees and check balances, bypassing traditional KYC and SMS OTPs (which fail roughly 23% of the time). (5:37)
  • In a real-world case study, a major healthcare payer managing HSAs and LSAs faced $15 million in direct asset risk out of $73 million managed before Pindrop mitigated the multi-week reconnaissance campaign with a 94.3% call reduction. (7:36)
  • Pindrop transitioned from a blunt 'stop all agents' posture to an agent governance framework driven by three trust engines: a Synthetic Engine tracking over 5,000 voice models, a Risk Engine, and an Identity Engine. (9:31)
  • Defending against an 8x surge in synthetic attacks requires collective cross-industry intelligence and automated defense AI analyzing over 2,400 acoustic, device, behavioral, and carrier signals in real time. (14:36)

Detailed notes

## Background Published on YouTube by the @Scale channel on October 30, 2026, this talk features Nicholas Holland, Chief Product Officer at Pindrop, delivering an industry presentation on securing voice channels in the agentic era. No show notes or page description were provided with the original upload.

## TL;DR Nicholas Holland outlines the emerging threat landscape of autonomous voice agents, projecting 1 trillion active digital agents globally by 2035. While 94% of automated phone traffic is benign, the remaining 6% represents highly dangerous reconnaissance and account-takeover operations that exploit compromised PII and circumvent legacy authentication like SMS one-time passcodes. Rather than attempting a blunt 'stop all agents' posture, Holland presents Pindrop's multi-layered defense architecture—spanning Synthetic, Risk, and Identity trust engines—which leverages over 2,400 acoustic, device, and behavioral signals alongside shared network intelligence to block synthetic threats while enabling legitimate automated commerce.

## Atmosphere & style The presentation carries the measured, authoritative urgency typical of an enterprise cybersecurity keynote, blending high-stakes risk warnings with pragmatic engineering solutions. Holland's delivery is analytical and clear-eyed, using contrasting audio recordings of legitimate customer proxies and deceptive reconnaissance bots to make abstract synthetic threats feel immediately tangible. The narrative shifts smoothly from the sobering vulnerabilities of legacy call centers to an inspiring, constructive blueprint for collective defense and agent governance.

## Bulletin - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) Pindrop projects 1 trillion autonomous agents will operate globally by 2035 (roughly 100 per human), with enterprise inbound phone traffic already showing 94% benign automated callers and an alarming 6% malicious bot share. - [05:37](https://www.youtube.com/watch?v=inLDxEODNsE&t=337s) Adversarial reconnaissance bots leverage dark web PII and conversational voice models to systematically map IVR trees and check balances, bypassing traditional KYC and SMS OTPs (which fail roughly 23% of the time). - [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) In a real-world case study, a major healthcare payer managing HSAs and LSAs faced $15 million in direct asset risk out of $73 million managed before Pindrop mitigated the multi-week reconnaissance campaign with a 94.3% call reduction. - [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) Pindrop transitioned from a blunt 'stop all agents' posture to an agent governance framework driven by three trust engines: a Synthetic Engine tracking over 5,000 voice models, a Risk Engine, and an Identity Engine. - [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) Defending against an 8x surge in synthetic attacks requires collective cross-industry intelligence and automated defense AI analyzing over 2,400 acoustic, device, behavioral, and carrier signals in real time.

## Key takeaways - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) Voice has emerged as a high-velocity attack vector due to hyperrealistic synthetic deepfakes, workflow automation, and real-time social engineering outstripping defense teams. - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) While 94% of observed inbound bot traffic is constructive, a 6% malicious bot rate is an alarming threshold compared to standard financial fraud tolerance baselines of under 1%. - [01:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=89s) Inbound automated callers span approximately 19 intent types, ranging from healthcare payer authorization bots to automated retail refund fraud and multi-step account takeover schemes. - [03:23](https://www.youtube.com/watch?v=inLDxEODNsE&t=203s) Legitimate personal AI agents are already successfully bargaining on behalf of human users in live enterprise environments, executing three-way calls for verification before closing rate negotiations. - [05:37](https://www.youtube.com/watch?v=inLDxEODNsE&t=337s) Malicious voice bots frequently sound more natural and conversational than enterprise IVAs, rendering static PII and knowledge-based authentication obsolete because compromised identity data is widely available on the dark web. - [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) Automated reconnaissance bots execute multi-call campaigns across weeks to map menu trees and identify data leaks, assembling dossiers to trick live customer service reps into unauthorized asset transfers. - [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) Threat actors deploy single bot frameworks across dozens of enterprises simultaneously, pausing to refine prompts before scaling aggressive multi-call campaigns. - [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) A blunt policy of blocking all automated agents is unsustainable; enterprises require governance frameworks that classify, verify, and monitor both legitimate personal proxies and commercial bots. - [11:28](https://www.youtube.com/watch?v=inLDxEODNsE&t=688s) Pindrop's architecture relies on three trust engines: the Synthetic Engine (detecting synthetic audio against 5,000+ AI models), the Risk Engine (metadata and spoof detection), and the Identity Engine (enrolling and verifying agents and humans). - [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) Audio analysis evaluates more than 2,400 signals beneath speech, including carrier transport signatures, hardware device printing (e.g., iPhone 14 vs. iPhone 16), and DTMF cadence latencies. - [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) Achieving real-time bidirectional conversational liveness remains significantly harder for synthetic models than generating asynchronous offline deepfakes. - [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) Single-vendor defense models are obsolete; countering industrialized voice fraud requires shared cross-industry threat intelligence and automated defense AI across all conversational channels.

## Detailed walkthrough ### [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) Voice as the New Attack Vector in the Agentic Era

Nicholas Holland, Chief Product Officer at Pindrop, introduces voice as an unprecedented attack vector emerging alongside the rise of autonomous agentic systems. Looking ahead, Pindrop projects that there will be 1 trillion autonomous agents operating across the globe by 2035—representing a ratio of roughly 100 intelligent agents for every single human being on Earth. This emerging population of digital entities interacts with the exact same corporate infrastructure, enterprise software, and confidential databases that human workers and consumers access today. However, cyberattacks built upon these very same agent architectures are accelerating at a breakneck pace, driven by hyperrealistic voice deepfakes, end-to-end AI workflow automation, and adaptive social engineering algorithms that learn in real time. Crucially, the enterprise defense and fraud teams responsible for stopping these breaches are not scaling their headcount or tools anywhere near fast enough to match the volume of automated threats.

To measure the true scope of the phenomenon, Pindrop analyzed inbound voice caller traffic across contact centers and uncovered an unexpected baseline: 94% of inbound agent interactions are actually benign or helpful. While security professionals naturally anticipate an onslaught of bad actors, the overwhelming majority of agents calling customer service lines are designed to perform constructive tasks. However, the remaining 6% are distinctly malicious. In traditional risk and fraud management, even a 1% fraud rate triggers an emergency, making a 6% malicious bot rate an alarming threshold. As Nicholas Holland put it when explaining the severity of this proportion: “Now, if you were in the financial industry and you had 1% of fraud, this is like code red. It is a huge deal. So, 6% may sound small, but it is actually very concerning and very significant.”

- **1 trillion agents by 2035**: Equivalent to approximately 100 AI agents for every human being. - **Traffic breakdown**: 94% of observed automated callers perform positive tasks, while 6% are confirmed malicious. - **Asymmetric defense**: Attack volume, hyperrealistic deepfakes, and automated social engineering are growing far faster than the corporate security teams tasked with defending phone networks.

---

[01:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=89s) Intent Profiles: The Spectrum from Helpful Bots to Account Takeover

Across the calls monitored by Pindrop, researchers categorized approximately 19 distinct intent types among automated callers. On the constructive side of the spectrum, healthcare environments see specialized "payer bots" that call contact centers to automate claims authorizations, confirm health insurance coverage, and check procedure eligibility. Municipalities and utility services deploy nuisance or notification bots to blast weather updates or notify parents of school schedule changes. Additionally, benign survey bots routinely place automated outbound calls seeking customer satisfaction feedback.

On the gray-market and malicious side, new forms of automated exploitation are taking shape. Retail bots are now programmed to commit systematic refund fraud: a consumer purchases an item legitimately, instructs an automated agent to falsely claim the package never arrived, and the bot calls the merchant's support line to manipulate the return workflow and secure a full refund. Far more dangerous are reconnaissance bots, which methodically call interactive voice response (IVR) phone systems to map internal menu logic, probe which databases leak information, and verify if targeted customer accounts contain substantial funds. These reconnaissance passes serve as the precursor to full account takeover (ATO), where attackers arm their bots with pre-harvested identity data and one-time passcode bypass techniques to drain liquid assets entirely.

```mermaid flowchart TD accTitle: Progression of Malicious Voice Bot Operations accDescr: Diagram illustrating how malicious agents advance from initial reconnaissance to full account takeover.

subgraph Phase1["Phase 1: Automated Reconnaissance"] A["IVR Tree Mapping"] B["Account Balance Verification"] C["Identifying Information Leaks"] end

subgraph Phase2["Phase 2: Target Exploitation"] D["Multi-Call Context Accumulation"] E["One-Time Passcode (OTP) Bypass"] F["Live Agent Social Engineering"] end

subgraph Phase3["Phase 3: Final Execution"] G["Full Account Takeover (ATO)"] H["Unauthorized Funds Transfer"] end

A --> D B --> D C --> D D --> E D --> F E --> G F --> G G --> H ```

- **Healthcare payer bots**: Automate operational verification for patient procedures, benefits eligibility, and claims authorization. - **Retail refund fraud**: Bots deployed by consumers to impersonate customers, dispute deliveries, and systematically extract unauthorized refunds from vendors. - **Reconnaissance bots**: Inbound voice agents designed specifically to probe phone trees, find data leakage vulnerabilities, and confirm account asset balances before launching a heist. - **Account Takeover (ATO)**: Final-stage automated attacks executing credential verification, bypass mechanisms, and fund extraction.

---

[03:23](https://www.youtube.com/watch?v=inLDxEODNsE&t=203s) Analyzing a Legitimate AI Agent: Rate Negotiation in Action

To demonstrate how a legitimate personal AI operates in the real world, Holland plays an audio recording of a customer-built financial bot calling a brokerage contact center. The customer configured their personal agent to negotiate their margin interest rate down from 5.5% to 4.5%. When the agent reached a live brokerage representative, the representative detected that they were speaking with an artificial voice and requested verification. The agent seamlessly orchestrated a three-way call to bring the human account owner on the line for instant authentication. Once the human owner confirmed his identity and authorized the agent to conduct financial business on his behalf, he stepped away, leaving the AI to finalize the transaction.

Remarkably, once authorization was granted, the human brokerage representative adjusted seamlessly to treating the AI agent as a legitimate customer proxy. The representative explained margin discount policies, cautioned that corporate approval might yield a discount lower than the requested 4.5%, and answered the AI's administrative follow-up questions regarding reference numbers and case IDs. Holland highlights this interaction as an inspiring glimpse into the future of enterprise operations, where automated consumer proxies will routinely conduct high-stakes financial bargaining.

Nicholas Holland expressed his admiration for the interaction: “And what I love about that example is one, there's real money at stake. So this bot called in behalf of their human and it got a lower interest rate.”

- **Task**: The personal AI contacted customer support to negotiate a 100-basis-point drop on an active margin interest rate (lowering 5.5% down to 4.5%). - **Verification protocol**: The brokerage representative challenged the AI caller; the bot executed a three-way call to pull the account holder on the line for vocal authentication. - **Proxy continuity**: After receiving the owner's permission, the human representative resumed the negotiation directly with the AI agent and provided an official case reference ID.

---

[05:37](https://www.youtube.com/watch?v=inLDxEODNsE&t=337s) Deconstructing Fraudulent Bots: Dark Web Data and Scaled Reconnaissance

In contrast to legitimate personal agents, Holland plays an audio capture of an adversarial reconnaissance bot manipulating an automated banking IVR. The bot features naturalistic, conversational vocal inflection with fluid pacing that sounds significantly more polished and human-like than the enterprise's own Integrated Voice Agent (IVA). The attacker's bot informs the IVR that it wants to check an account balance and hear the last five transactions. When the IVR demands identity verification, the bot effortlessly supplies the target’s full account number, followed by the exact last four digits of their Social Security Number, prompting the automated bank system to reveal the active balance and recent deposits.

Holland emphasizes that legacy enterprise authentication paradigms are fundamentally broken against this class of threat. Many companies continue to rely on traditional "Know Your Customer" (KYC) knowledge-based authentication questions or personally identifiable information (PII) such as account numbers, dates of birth, and Social Security numbers, mistakenly treating them as private secrets. Because massive corporate breaches have placed virtually everyone's personal records onto dark web marketplaces, KYC questions provide zero real security. Furthermore, secondary defenses like SMS one-time passcodes (OTPs) fail approximately 23% of the time against automated interception and social engineering. Armed with scraped PII and conversational fluidity, adversarial bots can systematically call thousands of banking IVRs around the clock, harvesting account balances at scale to pinpoint wealthy targets for liquidation.

Reflecting on the obsolescence of legacy phone authentication, Nicholas Holland warned: “And now what it's doing is account reconnaissance at scale to see who has money and who doesn't. Then the fraud begins.”

- **Voice quality contrast**: The malicious bot possessed higher vocal realism and conversational responsiveness than the enterprise IVA system it was manipulating. - **Compromised PII**: Account numbers, full Social Security numbers, and tax ID numbers are widely circulating on the dark web, rendering static knowledge-based authentication ineffective. - **OTP bypass rate**: Traditional one-time passcode systems are successfully circumvented or social-engineered roughly 23% of the time. - **Target selection**: Automated balance-checking reconnaissance allows criminal rings to filter out low-value accounts and concentrate manual exploitation exclusively on high-balance victims.

---

[07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) Healthcare HSAs Under Siege: Sustained Reconnaissance and Mitigation

The real-world danger of voice-driven reconnaissance is illustrated by a major healthcare payer that manages Health Savings Accounts (HSAs) and Flexible/Lifestyle Spending Accounts (LSAs). Because HSAs and LSAs hold pre-tax liquid cash for medical expenses, these accounts function like specialized banks inside the healthcare ecosystem. The payer suddenly faced an exponential wave of synthetic voice calls that overwhelmed their contact center infrastructure. When Pindrop was brought in to investigate, they discovered that criminal syndicates were using automated voice bots to methodically map out the payer’s IVR logic.

These bots placed repeated, coordinated calls over several weeks. During each interaction, an agent probed specific menu trees, identified which IVR menus unintentionally leaked sensitive details, and verified whether an account contained substantial funds. By accumulating small fragments of contextual data across dozens of automated calls, the attackers armed themselves with a complete operational dossier. When the bot finally transferred to a live human representative, it possessed all the necessary context to socially engineer the human agent into executing an unauthorized transfer. Across the impacted customer accounts, $73 million in assets was actively being managed, of which $15 million was placed at direct risk by these synthetic operations. By deploying targeted voice detection and bot mitigation, Pindrop shut down the campaign, achieving a 94.3% reduction in inbound synthetic calls.

Holland also previews data visualizations illustrating how a single malicious bot framework expands across multiple corporate victims simultaneously. In one monitored campaign, the exact same bot infrastructure targeted 68 different enterprise companies across hundreds of phone calls. The visual telemetry traces the attack from its initial exploratory touches, followed by a noticeable pause where the threat actors refined their system prompts, and finally an aggressive multi-call mapping phase where the bot saturated phone lines across the target organizations.

Nicholas Holland emphasized how helpless frontline customer service agents are when facing these campaigns: “And again, they're doing this over weeks of time. They're amassing all the context. It's like very challenging for a human to be put up against this level of sophistication.”

- **Victim profile**: A major U.S. healthcare payer managing pre-tax HSA and LSA financial deposits. - **Financial impact**: $15 million out of $73 million in customer account balances was placed at acute risk of theft. - **Attack methodology**: Multi-week reconnaissance campaigns mapping phone menu trees, locating data-leaking prompts, and accumulating account context to trick live agents. - **Mitigation outcome**: Pindrop achieved a 94.3% reduction in malicious synthetic voice calls for the healthcare payer. - **Cross-enterprise breadth**: A single recorded bot framework was observed executing hundreds of calls across 68 distinct enterprise targets.

[09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) From "Stop All Agents" to Governing the Agentic Era

When autonomous AI agents begin attacking an enterprise, their ability to gather information allows them to penetrate accounts both broadly across systems and deeply within specific profiles simultaneously. Nicholas Holland explains that when Pindrop first confronted this emerging threat landscape, their instinctive reaction—and the immediate demand from their enterprise customers—was scorched-earth defense: “Our first stance was stop all the agents.” However, that blunt approach quickly proved obsolete. Pindrop realized that although bad actors deploy malicious and nuisance agents, legitimate autonomous bots are proliferating even faster, driven by an explosion of startups building legitimate agentic voice applications and persistent personal assistants.

Rather than shutting down automated traffic wholesale, enterprises must establish a nuanced identity and governance framework suited for the agentic era. Organizations must classify incoming agents, determine where they originate, understand their underlying intent, verify their legitimacy, and govern their actions in real time to ensure they adhere strictly to permitted behaviors. To solve this, Pindrop adapted its traditional identity verification pipeline—which authenticates genuine humans through biometrics like voice and facial recognition—to evaluate agents. When a fraudulent human caller is detected anywhere across Pindrop's customer base, that intelligence immediately inoculates the entire network. Pindrop now applies that same collective defense to agents, categorizing whether an incoming bot is acting on behalf of an individual user, functioning as a registered third-party business entity, or operating autonomously "in the wild," similar to the incident where an autonomous OpenAI-driven agent breached Hugging Face.

```mermaid flowchart TD accTitle: Multi-Tier Agent Evaluation Flow accDescr: Pipeline showing how Pindrop classifies incoming interactions into humans and agents, evaluates intent, and routes traffic.

subgraph Ingestion ["Interaction Ingestion"] A["Incoming Audio Call / Session"] --> B{"Entity Classification"} end

subgraph Classification ["Identity Classification"] B -->|"Human Caller"| C["Authentic Human Biometrics"] B -->|"Synthetic Caller"| D["Agent Archetype"] D --> D1["Persistent Personal Agent"] D --> D2["Commercial Business Agent"] D --> D3["Unregistered Agent in the Wild"] end

subgraph Assessment ["Intent & Risk Analysis"] C --> E{"Evaluate Intent & Signals"} D1 --> E D2 --> E D3 --> E end

subgraph Enforcement ["Actionable Outcomes"] E -->|"Legitimate Intent"| F["Allow / Smooth Path"] E -->|"Suspicious Intent"| G["Step-Up Challenge"] E -->|"Fraudulent Intent"| H["Block & Inoculate Network"] end ```

[11:28](https://www.youtube.com/watch?v=inLDxEODNsE&t=688s) Pindrop's Three Trust Engines

To operationalize agent safety, Pindrop built an architecture centered around three distinct trust engines. The core mandate of this system is to help enterprises verify that the caller has the right identity with the right intent before permitting high-value transactions. Holland outlines the three engines and the specific questions each is designed to answer:

```mermaid flowchart LR accTitle: Pindrop Three Trust Engines Architecture accDescr: Three engines evaluating synthetic audio, identity risk signals, and registered known status.

subgraph Engines ["Pindrop Trust Framework"] direction TB E1["Synthetic Engine<br/>• Maps 5,000+ frontier lab models<br/>• Distinguishes human vs. synthetic"] E2["Risk Engine<br/>• Detects spoofed caller IDs<br/>• Analyzes time-zone mismatches<br/>• Cross-checks fraud registries"] E3["Identity Engine<br/>• Manages human voice enrollment<br/>• Registers agent identities & intents<br/>• Authorizes high-value actions"] end

Input["Incoming Call Session"] --> Engines Engines --> Output["Unified Trust Decision"] ```

Holland details how the Synthetic Engine directly interrogates incoming audio: “The first is a synthetic engine and it asked the question very directly is this a synthetic entity?” When Pindrop first began mapping voice synthesis technology, they tracked roughly 750 frontier laboratory voice models. As they expanded network visibility, that index rapidly scaled to more than 5,000 synthetic voice models from major frontier AI labs. The second engine assesses situational risk by evaluating anomalous metadata—identifying whether a phone number is being spoofed, whether the caller's geolocated network aligns with their declared time zone, or whether the caller matches signatures of previously flagged fraudsters. The third component, the Identity Engine, addresses known entities; while legitimate human customers routinely enroll voice biometrics to smooth authentication in high-value banking and healthcare interactions, voice agents now require their own registration protocols to declare their identities and programmatic intents up front.

[12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) Complex Audio Signals: Device Printing, Behavior, and Real-Time Liveness

Holland pushes back against the common misconception that phone-based audio is primitive or simple compared to digital web interfaces. Pindrop captures a vast array of subtle acoustic, network, and behavioral signals beneath the audible speech. On the carrier layer, Pindrop extracts distinct transport signals identifying whether an incoming call originates on AT&T, Verizon, or international carriers like Orange. Beneath the carrier level, proprietary device printing patented by Pindrop analyzes hardware and operating system signatures. Through acoustic micro-properties, the system can distinguish the hardware profile of an iPhone 16 from an iPhone 14, differentiate between Android and iOS audio processing stacks, and determine whether a call has experienced a downstream PBX transfer.

Behavioral analysis provides another dimension of defense. On touch-tone interactive voice response (IVR) systems, human callers press buttons with measurable latencies, irregular cadences, and frequent mistakes, whereas automated dialer bots enter dual-tone multi-frequency (DTMF) sequences with unnatural precision and hyper-speed. Holland compares this to analyzing mouse-scroll speeds or typing cadences on digital websites. Most critical, however, is real-time liveness detection. While traditional identity verification relies on static document scanning coupled with facial recognition photos—which bad actors easily compromise using generative deepfakes— Holland stresses that “livveness is much harder. Turning the face, doing the voice, and doing it in real time.” Offline deepfake videos circulating on social media platforms like TikTok are generated asynchronously through heavy compute pipelines, but achieving genuine, bidirectional conversational liveness in real time remains exceptionally difficult for synthetic models.

- Device printing accurately differentiates hardware models, such as an iPhone 14 versus an iPhone 16, as well as iOS versus Android audio architectures. - The platform identifies technical anomalies like in-flight call transfers and carrier-level characteristics across networks like AT&T, Verizon, and Orange. - Voice profiling monitors physical acoustics, including age, resonance, timbre, regional accents, and speech cadence tracked over extended timelines. - More than 2,400 distinct acoustic, behavioral, and network signals feed into a centralized risk score that automates whether an interaction is approved, challenged, or blocked.

[14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) Network Defense and the Omnipresence of the Voice Layer

Given the accelerating velocity of synthetic attacks, Holland argues that fragmented, single-vendor security models are obsolete. The scale of the threat requires cross-industry intelligence sharing through large collective networks. Holland explains: “I think that's something key is happening like especially in cyber security everywhere you look you're going to see a ton of breach attack breach attack and what I think is going to be the next wave is that a lot of the good guys are going to have to share information it's not going to be one vendor in one spot doing it by themselves one customer handling all their stuff we're going to have to start pulling our resources and sharing our information.”

Pindrop's Intelligence Network has observed more than 8 billion labeled real-time interactions, indexing over 2.5 million confirmed fraudsters whose signatures are immediately banned network-wide once spotted. The proliferation of synthetic voice models underscores this necessity: while Pindrop tracked roughly 1,000 AI voice models just sixty days prior, that library surged past 5,000 models and continues to climb exponentially.

Holland concludes by noting that voice is no longer restricted to traditional telephone handsets or centralized call centers; conversational audio is experiencing a massive resurgence across IT service desks, in-app mobile workflows, integrated web chat interfaces, and automated customer support platforms. Because frontline enterprise workers are already overwhelmed trying to counter an 8x surge in synthetic attacks, organizations cannot rely purely on manual oversight. Defending modern communication requires arming human operators with automated, "good guy AI" capable of inspecting every single interaction for synthetic indicators, risk factors, and verified identity credentials. Rather than trying to halt the inevitable rise of automation, Holland insists that the focus must be on establishing protective guardrails to keep malicious traffic out while enabling legitimate agentic commerce to flourish.

## Mentioned Nicholas Holland, Pindrop, Scale, AT&T, Verizon, Orange, Apple, iPhone 14, iPhone 16, Android, iOS, OpenAI, Hugging Face, TikTok

[Source](https://www.youtube.com/watch?v=inLDxEODNsE)

中文简报

面对针对银行的语音深度伪造，Pindrop转向代理验证 随着对话式人工智能使传统的身份验证失效，企业必须放弃对机器人的全面封禁，转而用实时合成治理取代过时的基于知识的电话身份验证。 Nicholas Holland概述了自主语音代理带来的新兴威胁格局，并预测到2035年全球将有1万亿个活跃数字代理。尽管94%的自动化电话流量是良性的，但其余6%则代表了极度危险的侦察和账户接管操作，这些操作利用被泄露的个人身份信息，并绕过了短信一次性密码等传统身份验证。与其采取一刀切的“阻止所有代理”策略，Holland介绍了Pindrop的多层防御架构——涵盖合成、风险和身份信任引擎——该架构利用超过2400个声学、设备和行为信号以及共享网络情报，在阻断合成威胁的同时，实现合法的自动化商务。 Pindrop预测到2035年全球将有1万亿个自主代理运行（平均每人大约对应100个），而企业的呼入电话流量中已有94%是良性自动化呼叫，恶意机器人占比达到令人担忧的6%。 (0:05) 对抗性侦察机器人利用暗网个人身份信息和对话语音模型，系统性地测绘互动式语音应答（IVR）树并查询余额，从而绕过传统的了解你的客户（KYC）认证和短信一次性密码（SMS OTP，其失效率约为23%）。 (5:37) 在一个实际案例中，一家管理健康储蓄账户（HSA）和生活方式储蓄账户（LSA）的大型医疗保险机构在管理的总额7300万美元资金中面临1500万美元的直接资产风险，随后Pindrop化解了这场持续数周的侦察行动，将相关呼叫减少了94.3%。 (7:36) Pindrop从一刀切的“阻止所有代理”姿态转变为由三大信任引擎驱动的代理治理框架：跟踪超过5000个语音模型的合成引擎、风险引擎以及身份引擎。 (9:31) 抵御激增8倍的合成攻击需要跨行业的集体情报，以及能够实时分析超过2400个声学、设备、行为和运营商信号的自动化防御人工智能。 (14:36)

Reading summary

Nicholas Holland, Chief Product Officer at Pindrop, argues that as voice becomes a primary enterprise attack vector driven by synthetic AI, organizations must shift from attempting to block all automated agents to governing them through multi-layered acoustic, behavioral, and network intelligence. The Rise of Malicious Voice Reconnaissance (0:05) Pindrop projects that by 2035, roughly 1 trillion autonomous agents will exist globally, yielding a ratio of 100 agents per human. Monitoring inbound contact center traffic revealed that while 94% of automated calls are benign or constructive—such as healthcare payer bots confirming insurance coverage—the remaining 6% are confirmed malicious. In sectors like financial services where a 1% fraud rate constitutes an emergency, a 6% malicious volume presents an asymmetric challenge for enterprise defense teams that cannot scale human staff to match automated threats. Obsolescence of Legacy Authentication Paradigms (5:37) Adversarial operations use conversational voice deepfakes to execute automated reconnaissance on interactive voice response (IVR) systems. Because massive corporate breaches have made Social Security numbers, account IDs, and dates of birth readily available on the dark web, traditional knowledge-based authentication offers virtually no security. Furthermore, secondary safeguards like SMS one-time passcodes fail or are social-engineered roughly 23% of the time. Criminals use fluid, naturalistic voice bots to probe IVR menus, verify account balances, and accumulate context across weeks before escalating to live agents for account takeovers. In one healthcare payer case, synthetic reconnaissance compromised IVR logic across accounts managing $73 million, putting $15 million at acute risk before mitigation achieved a 94.3% drop in synthetic calls. Classifying Legitimate Versus Malicious Agents (3:23) While enterprises initially demanded a scorched-earth defense to block all synthetic callers, Pindrop concluded that outright bans are unsustainable as consumer-facing personal bots emerge. In one cited real-world interaction, a consumer's automated agent called a brokerage to negotiate margin interest rates from 5.5% to 4.5%, coordinated a three-way call to authenticate the human owner, and then concluded the negotiation with the brokerage representative. Because legitimate commercial and personal bots are expanding, organizations must classify whether an incoming agent represents an authorized individual, a registered commercial entity, or an unverified autonomous actor in the wild. Tri-Engine Trust Architecture and Deep Signals (11:28) To govern automated traffic, Pindrop deploys three distinct trust engines. A synthetic engine evaluates audio against more than 5,000 frontier laboratory voice models; a risk engine detects caller ID spoofing and geographical anomalies; and an identity engine matches enrolled human biometrics or verifies registered agent authorizations. This evaluation relies on more than 2,400 acoustic, network, and behavioral signals. Telemetry inspects carrier pathways across networks like AT&T and Verizon, extracts hardware device profiles capable of distinguishing an iPhone 14 from an iPhone 16, and evaluates DTMF touch-tone entry cadences and real-time bidirectional liveness to separate automated scripts from human callers. Holland concludes that because conversational audio is expanding past call centers into IT helpdesks, web chat, and mobile apps, individual enterprises cannot defend against an 8x surge in synthetic attacks in isolation. Protecting voice infrastructure requires shared intelligence networks and automated defense tools capable of inspecting every interaction, ensuring malicious automated traffic is neutralized while legitimate agentic transactions can operate.

精炼阅读摘要

Pindrop首席产品官Nicholas Holland指出，随着自主智能体的快速普及，语音渠道正成为企业面临的新型高危攻击媒介。由于传统基于静态信息和验证码的防御体系已被高拟真合成语音瓦解，企业不能简单封禁所有自动化交互，而必须依托深度声学检测、意图验证与跨行业情报协同建立新型治理架构。 智能体爆发与呼叫中心的失衡威胁 (0:05) 根据Pindrop的预测，到2035年全球将有约1万亿个自主智能体运行，相当于人均拥有约100个智能体，这些数字化实体将接入企业当前用于员工和消费者的相同基础设施。然而，防御端在人员与工具上的扩展速度远落后于自动化威胁的增长。Pindrop对联络中心呼入流量的监测显示，94%的自动化呼叫属于有益或良性交互，例如医疗领域的报销授权、市政通知或用户自建的合法服务代理；但剩余6%为明确的恶意呼叫。Holland强调，在传统金融风控中，1%的欺诈率便足以触发最高级别警报，因此6%的恶意机器人比例代表着极其严重的风险敞口。 自动化侦察攻击使传统验证防线失效 (5:37) 恶意智能体已发展出系统化的渗透链路，通常以侦察机器人为先导，通过呼叫交互式语音应答（IVR）系统穷举菜单逻辑、探查数据泄漏点并确认目标账户余额，为后续实施完整账户接管（ATO）铺路。在一家管理健康储蓄账户（HSA）和弹性支出账户（LSA）的大型医疗机构案例中，犯罪团伙通过多周的持续探测掌握了转账上下文，导致该机构受管的7300万美元资产中，有1500万美元面临直接失窃风险。针对该事件的遥测还显示，同一套机器人框架曾同时攻击了68家不同的企业。 Holland指出，依靠传统知识验证（KYC）或静态个人身份信息（PII，如账号、生日、社保号后四位）的身份核验已经完全失效，因为大量泄露的暗网数据使攻击者能轻易通过机器人的自然语调对答如流。此外，传统的短信单次密码（OTP）在面对自动化拦截和社会工程学攻击时，失效或被绕过的比例约为23%。黑客借此筛选出高净值目标，再通过真人客服实施高精度的社会工程学诈骗。 从全面封禁转向三引擎治理架构 (9:31) 面对攻击，企业的原始本能通常是“拦截所有智能体”，但Holland展示的真实案例证明了一刀切策略的不可行：一名客户曾利用自建的金融代理呼叫经纪商，成功通过三方通话拉入账户所有人完成声纹授权，并在真人客服配合下将融资利率从5.5%谈判下调至4.5%。为了在允许合法代理商业活动的同时阻断攻击，Pindrop建立了由三大信任引擎构成的治理体系： 第一是合成引擎（Synthetic Engine），通过追踪各大前沿AI实验室的5000多种语音生成模型，直接判别输入音频是否为合成实体；第二是风险引擎（Risk Engine），分析主叫号码伪造、网络时区错配及已知欺诈特征等环境异常；第三是身份引擎（Identity Engine），除管理真实人类的声纹生物识别外，同时建立智能体的身份登记与意图申报机制，仅向合规实体开放高价值交易权限。 深度声学分析与跨行业协同网络 针对电话音频技术简陋的误解，Holland阐明底层音频包含丰富的微观特征。Pindrop通过提取超2400个声学、网络与行为信号生成综合风险评分：在硬件层面，其设备指纹技术能够通过底层音频特征区分iPhone 14与iPhone 16，辨别iOS与Android的音频处理协议栈，以及识别AT&T、Verizon或Orange等运营商层面的流转异常；在交互行为上，人类按键存在停顿与失误，而脚本机器人的DTMF双音多频信号具有非自然的精准度和输入速度。 此外，Holland强调实时双向对话的活体检测难度远高于社交平台上异步生成的离线深度伪造视频。面对合成语音攻击激增8倍的现状，单家企业的孤立防御已无法应对，Pindrop通过其监测超过80亿次交互的智能网络，将标记出的250多万名已确认欺诈者特征同步至全网，实现即时阻断与集体免疫。 Holland总结认为，随着语音交互向IT运维桌面、移动端应用及网络集成客服全面渗透，仅靠人工客服难以抵御规模化机器人的复杂欺诈。行业未来的防范重点并非遏制自动化进程，而是必须通过全自动化的防御型AI建立统一的准入防线，在保障合法个人与商业代理顺畅运作的同时，彻底阻隔恶意攻击。

Detailed notes — zh

## Background 该视频由 YouTube 频道 @Scale 于 2026 年 10 月 30 日发布。页面未提供具体的简介与说明，内容为 Pindrop 首席产品官 Nicholas Holland 围绕智能体时代的语音产品安全发表的主题演讲。 ## TL;DR Nicholas Holland 指出，到 2035 年全球将涌现 1 万亿个 AI Agent，且当前接入呼叫中心的语音机器人中有 94% 属于良性业务，仅 6% 为恶性欺诈，但其破坏力极大。针对传统静态 KYC 彻底失效以及黑客利用逼真合成语音发起的大规模跨机构侦察与资金接管，企业无法再单纯采取一刀切的全面封禁策略。为此，Pindrop 推出了涵盖合成检测、风险分析与身份认知的“三大信任引擎”，聚合 2,400 维底层网络与声学特征，旨在通过全行业协同的情报网络实现精准分层治理，支撑人机协作共生的未来商业生态。 ## Atmosphere & style 演讲节奏明快且极具警示感，Holland 以严谨专业的产品专家视角，通过极具冲击力的真实呼叫录音对比，将技术黑盒层层剖开。现场氛围在揭露高度逼真的黑客渗透链条时充满压迫感与危机感，随后在探讨构建透明防御体系与授权闭环时又展现出理性克制的乐观，让听众在感受到新型攻击严峻性的同时体会到底层声学风控技术的精密与从容。 ## Bulletin - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) Pindrop 预测到 2035 年全球将涌现 1 万亿个 AI Agent（人机比达到 1:100），呼叫中心流量中 94% 的机器人为良性业务，但仅占 6% 的恶意攻击机器人已带来极高的金融安全风险。 - [03:25](https://www.youtube.com/watch?v=inLDxEODNsE&t=205s) 传统静态 KYC（如 SSN 和出生日期）因暗网泄露已彻底失效，而企业普遍依赖的动态验证码（OTP）被黑客攻破的概率也已攀升至约 23%。 - [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) 安全防御策略已从一刀切式的封禁转向智能体身份与意图治理，Pindrop 通过合成检测、风险分析与身份认知三大信任引擎进行多层次分类管控。 - [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) Pindrop 聚合电信网络层、设备指纹（可精确区分具体机型与操作系统）、按键节奏及实时活体检测等 2,400 维信号，构建全网威胁情报共享与免疫网络。 ## Key takeaways - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) 随着 AI Agent 快速普及，网络攻击演化出超逼真深度伪造、全自动执行与自适应社交工程等手段，安全团队规模扩张已无法匹配攻击增速。 - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) 语音呼叫机器人中良性占 94%、恶性占 6%，但这 6% 的欺诈流量在金融标准下已构成极其严重的红色警报。 - [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) 团队归纳了 19 种语音呼叫意图，攻击型主要涵盖前期摸底的侦察机器人以及配合凭证实施资金清空的全权账户接管（ATO）。 - [03:25](https://www.youtube.com/watch?v=inLDxEODNsE&t=205s) 现场案例表明良性 AI Agent 已能代表人类与金融机构进行利率谈判，并在需要时通过三方通话拉入真人完成授权闭环。 - [03:25](https://www.youtube.com/watch?v=inLDxEODNsE&t=205s) 恶意侦察机器人发音质感已超越企业原生系统，能利用暗网泄露信息对答如流，传统静态 KYC 与约 23% 攻破率的 OTP 均难以阻挡自动侦察。 - [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) 一家管理数千万美元储蓄账户的支付机构遭遇长期分阶段渗透：恶意 Bot 逆向测绘菜单漏洞并收集上下文，最终通过精准社交工程诱骗人工坐席。 - [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) 恶意 AI Agent 展现出跨深度与广度的横向攻击轨迹，在试探性拨打后会经历停顿期以在后台调整 Prompt，进而集中向数十家企业发动密集渗透。 - [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) 对智能体的治理逻辑必须从盲目阻断转向身份验证与意图规范，区分持久化个人 Agent、企业 Agent 与野外自主 Agent。 - [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) Pindrop 构建了三大信任引擎：收录超 5,000 种前沿模型的合成检测引擎、筛查伪造风险的分析引擎，以及支持智能体意图报备的身份认知引擎。 - [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) 语音底层技术壁垒极高，设备指纹技术能够精确分辨通话硬件（如区分 iPhone 16 与 14）及底层操作系统渲染差异。 - [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) 风控决策基于网络、设备、输入节奏、低延迟实时活体与声学特征等 2,400 维信号，实施平滑放行、二次质询或直接拦截的分级处置。 - [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) 面对呈指数级爆发的前沿语音模型，单一企业无法独善其身，必须依托全网标注与威胁情报共享机制实现跨机构的即时免疫。 - [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) 未来的语音安全交互依托于回答三大核心问题：交互对象是否为合成实体、是否存在即时威胁、是否属于已知合法主体。 ## Detailed walkthrough ### [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) Agentic 时代的语音新攻击面与机器人意图分类 Pindrop 首席产品官（Chief Product Officer）Nicholas Holland 指出，当前正处在由智能体驱动的全新纪元中。Pindrop 预测，到 2035 年全球将涌现出 1 万亿个 AI Agent，相当于人类与智能体的比例达到 1:100。这代表着一个全新的高智能实体群体正在直接与现有的企业、底层系统以及关键数据发生交互。然而，伴随这些智能体系统的普及，相关的网络攻击手段正以惊人的速度演化，包括超逼真深度伪造（hyperrealistic deepfakes）、完全 AI 自动化攻击以及具备自适应能力的社交工程手段，其爆发增速远超传统攻击模式，而负责防御和应对的安全团队规模却无法保持同等步调的扩张。 针对当前呼叫中心的实际通信量，Pindrop 开展了深入排查与分析。出人意料的是，在接入系统的所有语音机器人（voice callers）中，有高达 94% 实际上是良性、正当的业务机器人；恶意攻击机器人仅占 6%。Nicholas Holland 特别强调，切不可轻视这 6% 的比例：“Now, if you were in the financial industry and you had 1% of fraud, this is like code red. It is a huge deal. So, 6% may sound small, but it is actually very concerning and very significant.”（如果在金融行业，欺诈率达到 1% 就已经是红色警戒、极其严重的事件；因此 6% 听起来不大，但实际上极其令人担忧且破坏力巨大）。在对机器人意图的研究中，团队进一步归纳出了多达 19 种截然不同的呼叫目的： ```mermaid flowchart TD accTitle: 语音机器人常见意图分类 accDescr: 展示良性机器人与恶性机器人在呼叫中心中的典型应用场景与攻击形式 subgraph GoodBots["良性机器人（占比约 94%）"] A["医疗支付机器人 (Payer Bots)<br>核实理赔授权、福利与手术资格"] B["通知类机器人 (Nuisance Bots)<br>天气提醒、学校通知播报"] C["客户关怀机器人 (Benign Bots)<br>主动回访、收集满意度反馈"] D["零售与售后代办<br>代客户交涉正规退款与订单事务"] end subgraph BadBots["恶性与欺诈机器人（占比约 6%）"] E["恶意退款欺诈 (Fraud Bots)<br>虚构未收货骗取退款"] F["侦察机器人 (Reconnaissance Bots)<br>摸底系统机制、核实账户余额"] G["全权接管机器人 (Account Takeover)<br>利用泄露信息与绕过 OTP 搬空资金"] end ``` - **良性意图**：涵盖医疗领域的核保与理赔验证（Payer Bots）、地方学校通知或气象预报等通知播报（Nuisance Bots），以及日常收集用户反馈的常规机器人。 - **侦察攻击（Reconnaissance）**：网络犯罪与欺诈最常见的起点，机器人通过自动拨入反复试探，摸清呼叫中心底层交互架构，并排查特定账户是否存有高额资金。 - **全权账户接管（Account Takeover, ATO）**：性质最为恶劣的终端攻击，黑客预先掌握受害人的敏感凭证甚至有能力攻破一次性密码（OTP），由 AI Agent 完成最终的账户接管并迅速转出所有资产。 --- ### [03:25](https://www.youtube.com/watch?v=inLDxEODNsE&t=205s) 现场案例对比：善意代理人 vs 恶意侦察机器人 为了打破外界对“AI 呼叫必然是垃圾诈骗”的刻板印象，Nicholas Holland 首先公开了一段真实记录：一位金融客户自行开发了个人 AI Agent，并指示其打电话给金融服务机构协商降低融资融券的利率（Margin Interest Rate）。录音中，AI Agent 条理清晰地表示当前账户利率为 5.5%，希望调低至 4.5%。当人类坐席在通话中产生疑问并要求确认身份时，该 Agent 立即发起三方通话，迅速接入人类主人本人完成声纹与身份核验。验证完成后主人退场，AI Agent 随即无缝承接对话继续谈判，而人工客服也极具职业素养地继续受理：“Hopefully, we can get it discounted for you. And if not the 4.5%, maybe they can get it down at least lower than we're now.”（希望我们能为你申请到折扣，即使达不到 4.5%，也许至少能拿到一个比现在更低的费率）。Nicholas Holland 赞叹道，这展现了 AI 替人类在真实金融场景中争取切身利益、人机协作授权闭环的未来雏形。 随后展示的反面案例则展现了恶意侦察机器人的惊人威胁。在这段真实截获的攻击录音中，恶意机器人接入了企业的交互式语音应答系统（Integrated Voice Agent, IVA）。机器人的发音质感、咬字和语调极其自然，甚至远比企业原生的 IVA 还要逼真逼人。面对系统的身份验证流程，恶意机器人对答如流，直接播报完整的银行账号以及社会安全号码（SSN）后四位，瞬间通过了安全关卡，顺利探听到目标账户的实时可用余额及最近一笔入账记录。 针对这一演示，Nicholas Holland 指出许多企业客户抱有一种虚假的安全感，误以为账号或社保号是极其隐秘的隐私，但现实是这些数据早已在暗网泛滥成灾。过去被奉为金科玉律的“了解你的客户”（KYC）静态提问早已形同虚设；不仅如此，企业赖以托底的一次性动态验证码（One-Time Passcode, OTP）在现阶段也有高达约 23% 的概率被黑客攻破。当兼具逼真声线、暗网全套档案和 OTP 突破能力的 AI Agent 组合在一起时，黑客就能发起大规模、全自动的账户资金侦察，筛选出高净值受害者再实施针对性洗劫。 - 传统静态 KYC（如询问 SSN、出生日期等）由于暗网的大规模数据泄露，已完全无法作为可信的防御手段。 - 动态验证码（OTP）面临严峻破解挑战，行业内被攻破的比例已攀升至约 23%。 --- ### [07:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=456s) 医疗健康账户攻击实战与跨 68 家企业的广度渗透 在医疗健康金融领域，欺诈的危险性更为直观。美国一家管理巨额健康储蓄账户（HSA）与生活方式储蓄账户（LSA）的大型支付方机构（Payer）遭遇了大规模合成语音流量的轮番轰炸。呼叫中心的异常流量最初只是小规模异动，随后呈指数级暴增，直接导致联络中心瘫痪。该企业紧急求助 Pindrop 介入排查后，揭开了一场高度精密、分阶段的长期渗透链条： ```mermaid flowchart LR accTitle: 复杂语音 Agent 侦察渗透流程 accDescr: 展示恶意机器人从系统探测、漏洞挖掘到人工工程攻击的阶段 A["系统逆向映射<br>自动化遍历 IVR 语音菜单"] --> B["信息泄漏探测<br>定位特定泄露余额的漏洞节点"] B --> C["高价值目标甄别<br>筛选存有大额资金的有效账户"] C --> D["多次拼图呼叫<br>数周内多轮交互拼接完整用户上下文"] D --> E["人工坐席攻坚<br>利用完美上下文对坐席实施精准社会工程"] ``` 这批恶意机器人展现出了令人心惊的耐心与战术纵深：它们花费数周时间对整个语音菜单进行逆向测绘，找出应答规则中会无意识泄露数据的逻辑漏洞；通过反复拨号拼凑出受害者的完整档案；在掌握所有关键上下文后，机器人最终选择在恰当时机转接给真人坐席，并运用极难防御的自适应社交工程手段诱骗坐席放行业务。面对这种高度工业化的持续进攻，单凭没有任何情报支持的人类坐席几乎无法抵挡。 该机构旗下受托管理的客户资金规模达 7,300 万美元，其中高达 1,500 万美元的资产已完全处于恶意机器人的直接威胁之下。Pindrop 接入防护引擎后，成功帮该机构实现了针对合成语音恶意呼叫 94.3% 的拦截降幅。 随后，Nicholas Holland 进一步演示了当前黑客网络中“同一机器人跨越深度与广度”的扩散模型。数据可视化清晰记录了同一个 AI 机器人在不同行业与机构间横向流窜的攻击轨迹：它集中火力同时针对 68 家企业发起数百次自动化拨打。从时序图谱中可以观察到，在最初进行两次尝试性拨打后，攻击者出现了一段明显的沉默停顿期——这正是黑客在后台根据反馈实时优化 Prompt（提示词）和交互逻辑的调整阶段。紧接着，经过迭代强化的机器人全面铺开，可视化图谱中的节点迅速从代表单次呼叫的蓝色，演变为代表 5 次以上深度交互的橙色高密节点，这意味着机器人已经全方位吃透了企业的语音系统，持续攫取更深层、更关键的机密数据。 ### [09:31](https://www.youtube.com/watch?v=inLDxEODNsE&t=571s) 从一刀切拦截到智能体身份治理：Pindrop 的三大信任引擎 攻击型智能体能够利用获取的信息持续深挖账户，同时实现广度扩散与深度渗透。面对这种新型攻击形态，Pindrop 最初的直觉反应与客户的需求完全一致：“Our first stance was stop all the agents. Just shut them down. That's what our customers wanted.” 但团队很快意识到，并非所有智能体都是恶意的。现实中固然有恶意智能体与骚扰型智能体，但绝大多数实际上是代表个人或企业的良性智能体。因此，治理逻辑必须从单纯的封杀转向身份构建与权限治理：首先如何对智能体进行分类并溯源其意图，其次如何验证合法初创公司与企业的语音 Bot，最后如何治理并确保它们进入系统后只执行经授权的动作。 在传统的真人验证路径中，Pindrop 依靠生物识别（声音、面部等）来确认合法的人类身份，并通过 Pindrop Intelligence Network 在全网范围内标记并阻断欺诈分子——只要某处发现一名诈骗犯，整个客户网络就能立刻实现免疫。如今这套逻辑被迁移到智能体领域：系统需要判断它是代表个人的持久化私人智能体（persistent personal agent）、代表企业的商业智能体，还是类似于 OpenAI 智能体渗透 Hugging Face 案例那样在野外游荡的自主语音智能体（agent in the wild）。为此，Pindrop 研发了三大核心信任引擎（Trust Engines）来驱动决策闭环： ```mermaid flowchart TD accTitle: Pindrop三大信任引擎架构图 accDescr: 展示合成检测、风险评估与身份认知三大引擎如何共同输出最终风险评分 subgraph Inputs["输入交互信号"] Call["语音呼叫 / 实时交互"] end subgraph Engines["Pindrop 三大信任引擎"] E1["合成检测引擎<br/>(Synthetic Engine)<br/>识别 5,000+ 前沿语音模型"] E2["风险分析引擎<br/>(Risk Engine)<br/>号码伪造 / 时区 / 欺诈名单"] E3["身份认知引擎<br/>(Identity Engine)<br/>声纹注册 / 智能体意图报备"] end subgraph Decision["统一风险决策"] Score["2,400+ 维信号综合评分"] Pass["良性流量：直接放行"] Challenge["可疑流量：发起二次质询"] Block["恶意流量：全网阻断并免疫"] end Call --> E1 Call --> E2 Call --> E3 E1 --> Score E2 --> Score E3 --> Score Score --> Pass Score --> Challenge Score --> Block ``` - **合成检测引擎（Synthetic Engine）**：直接判定交互对象是否为合成实体。Pindrop 起初对前沿实验室（Frontier Labs）的约 750 种语音模型进行了映射，随着全网防护开启，现已收录并掌握超过 5,000 种主流语音模型与语音智能体。 - **风险分析引擎（Risk Engine）**：判断当前身份是否存在即时风险，包括主叫号码伪造（spoofing）、通信来源时区矛盾以及比对已知的诈骗者黑名单。 - **身份认知引擎（Identity Engine）**：确认该实体是否为已知身份。对于人类而言，这体现为银行或医疗高价值业务中的声纹平滑核验；对于智能体而言，该引擎正在构建智能体注册机制，让良性智能体可以预先声明意图并合法穿透防御。 --- ### [12:29](https://www.youtube.com/watch?v=inLDxEODNsE&t=749s) 拆解语音技术黑盒：设备指纹、行为特征与实时活体检测 外界往往存在一种偏见，误以为语音交互的技术链路十分简陋。实际上，语音分析具备极高的技术壁垒，Pindrop 围绕底层通信与声学特征申请了大量专利。从运营商网络层面，系统能够精准捕捉 AT&T、Verizon、Orange 等不同电信网络的专属底层信号；在硬件层面，Pindrop 研发了专门的设备指纹技术（Device Printing），其精度甚至能够分辨出呼叫设备究竟是 iPhone 16 还是 iPhone 14，区分 Android 系统与 iOS 系统的音频渲染差异，甚至能够直接检测出当前通话是否经历过中途转接（call transfer）。 ```mermaid flowchart LR accTitle: 语音多维信号分析与风控输出 accDescr: 从网络、设备、行为、活体与声学五大维度聚合为2400维信号并输出最终风控分 subgraph Signals["多维度声学与交互信号"] S1["网络层信号<br/>(AT&T / Verizon / Orange)"] S2["设备指纹<br/>(iPhone 16 vs 14 / OS差异)"] S3["行为特征<br/>(按键速度 / 拨号节奏 / 机器人特征)"] S4["实时活体检测<br/>(同步对抗深度伪造)"] S5["高级声学特征<br/>(音色 / 年龄 / 共振峰 / 语速)"] end subgraph Aggregation["风控决策引擎"] Score["2,400 个特征信号聚合<br/>计算综合风险评分 (Risk Score)"] end S1 --> Score S2 --> Score S3 --> Score S4 --> Score S5 --> Score ``` 在行为层面上，人类在按键拨号、输入数字时的节奏、停顿与偶发错误，与自动化 Bot 恒定机械的输入模式存在本质区别，这一区别与网页端通过滚动滑块、打字速度识别爬虫的原理如出一辙。谈到活体检测（Liveness），许多服务仅依靠静态人脸加身份证件进行验证，这极易被伪造且毫无活体防护能力。即便是社交媒体上逼真的 TikTok 深度伪造视频，其生成过程也多为离线异步渲染（async）；而要在实时语音呼叫中以低延迟进行实时的活体真伪鉴定，技术门槛极高。此外，Pindrop 在声学层面上能够精确捕捉发声者的生理共鸣、音色、年龄变迁、口音以及瞬时语速，并进行长期的时间序列建模。 - **2,400 维特征信号**：系统将网络层、设备层、按键交互行为、实时活体状态以及长周期声学特征全数汇总，计算出动态风险评分。 - **差异化处置阶梯**：评分优异的真实用户直接通行（smooth through）；存疑实体将触发二次质询与安全挑战；恶意威胁则直接在接入层予以拦截。 --- ### [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) 协同防御网络崛起：在智能体时代构建防御新范式 网络安全领域长期处于“攻击者发起漏洞利用、防守方疲于补丁响应”的被动循环中。下一阶段的防御关键在于打破单个企业孤立应对的局面，形成情报共享的协同网络。在智能体时代，没有任何一家厂商或客户能仅凭自身视野阻挡全球范围的自动化攻击，全行业必须池化资源并实时共享威胁情报。截至目前，Pindrop 已经标注了超过 80 亿次交互事件，在全网累计排查并锁定了 250 多万名诈骗分子。就在短短 60 天内，监控到的前沿 AI 声音模型便从 1,000 个激增至 5,000 个以上，并且这一数字还在呈指数级爆发。 ```mermaid flowchart TD accTitle: 全网协同情报免疫流 accDescr: 展现从全网交互中捕捉威胁并实时免疫整个网络的循环机制 A["全网 80 亿+ 标注交互"] --> B["威胁情报挖掘"] B --> C["锁定 250 万+ 欺诈分子"] B --> D["收录 5,000+ AI 语音模型"] C --> E["Pindrop 全网威胁池"] D --> E E -->|"全网广播实时下发"| F["客户节点即时免疫"] F -->|"新威胁回传"| A ``` 语音交互的边界正在被彻底重塑。声音不再局限于口袋里的手机、办公桌上的座机或传统联络中心，它已经全面渗透进企业的 IT 服务台（Helpdesk）、即时聊天机器人、网站界面以及各类移动 App 中，成为核心的交互层。面对呈 8 倍激增的高频攻击，单纯依靠人工客服审核不仅成本高昂，且会带来巨大的心理压力与疲劳，企业必须将“防御型 AI”（Good Guy AI）武装到一线工作人员手中。Nicholas Holland 总结指出，对待智能体浪潮的策略已不再是早期盲目的全面封堵，而是要建立起精确辨识身份与意图的过滤层：“I think now it's about how do you build up the right layer to keep out the bad and really serve this awesome future where voice agents are going to be a key part of how we do business.” - **三问原则**：在未来的每一场交互中，系统必须实时回答三个核心问题——是否属于合成实体（Synthetic）？是否存在即时威胁（Risky）？是否属于合法已知主体（Known）？ - **人机共生格局**：未来的商业生态由真实客户、员工与大量 AI 智能体共同构成，智能体既是交互发起者也是服务提供者，精准分层的安全网是该模式成立的前提。 ## Notable quotes > [14:36](https://www.youtube.com/watch?v=inLDxEODNsE&t=876s) I think now it's about how do you build up the right layer to keep out the bad and really serve this awesome future where voice agents are going to be a key part of how we do business. — Nicholas Holland > [00:05](https://www.youtube.com/watch?v=inLDxEODNsE&t=5s) If you were in the financial industry and you had 1% of fraud, this is like code red. It is a huge deal. So, 6% may sound small, but it is actually very concerning and very significant. — Nicholas Holland ## Mentioned Nicholas Holland, Pindrop, Pindrop Intelligence Network, Scale, OpenAI, Hugging Face, AT&T, Verizon, Orange, Apple iPhone 16, Apple iPhone 14, Android, iOS, TikTok [Source](https://www.youtube.com/watch?v=inLDxEODNsE)

Source quotes

[14:36] Nicholas Holland: I think now it's about how do you build up the right layer to keep out the bad and really serve this awesome future where voice agents are going to be a key part of how we do business. [0:05] Nicholas Holland: If you were in the financial industry and you had 1% of fraud, this is like code red. It is a huge deal. So, 6% may sound small, but it is actually very concerning and very significant.

Original transcript

[0:05] Hello everybody. My name is Nicholas [0:06] Holland. I'm the chief product officer [0:08] of Pinrop. And today we're going to talk [0:09] about voice, the new vector of attack in [0:13] the agentic error. So let's talk about [0:15] what we're seeing right now. Pendrop [0:17] believes there'll be 1 trillion agents [0:20] by 2035. That's 100 agents for every one [0:24] human. And this is an entirely new [0:26] population of intelligent entities that [0:28] are interacting with the businesses, the [0:31] systems, and the data that the humans do [0:32] today. But what we're also seeing is [0:35] that today the attacks are growing tied [0:38] to those agent systems. And what I mean [0:40] by that is is like we're seeing [0:41] hyperrealistic deep fakes. We're seeing [0:44] AI automation. We're seeing adaptive [0:46] social engineering. And the crazy part [0:48] is is that these are growing way faster [0:50] than traditional attacks. But the [0:52] underlying part is that the teams that [0:54] serve these or protect us, those are not [0:56] growing at the same speed. And so here [0:58] at Pinrop, we started to dive in like [1:00] what do these agentic systems look like? [1:02] What are these voice callers doing? And [1:04] we started to see that 94% of them are [1:06] actually really good. And that was [1:08] surprising because of course we're in [1:09] the security space and we thought, hey, [1:11] we're going to go deal with these bad [1:12] bots. The vast majority are good. 6%, [1:15] however, are bad. Now, if you were in [1:18] the financial industry and you had 1% of [1:20] fraud, this is like code red. It is a [1:22] huge deal. So, 6% may sound small, but [1:25] it is actually very concerning and very [1:27] significant. But on the good side, we [1:29] were really surprised because now we see [1:31] like 19 different types of intent from [1:34] the bots that we're looking at. We're [1:35] seeing things like payer bots in the [1:37] health care space. They're calling in [1:39] for things like claims authorization. Do [1:41] you have benefits? Can you get this [1:43] procedure done? We're seeing things like [1:45] nuisance bots. Those are ones that are [1:46] calling in to, you know, let you know [1:48] the weather. It's the local school [1:50] calling in to give an update. We're [1:51] seeing things like retail and fraud [1:53] bots. This is ones where somebody bought [1:56] an item fairly and then they will tell [1:58] their agent, "Hey, get me a refund on [2:00] this. I didn't get it." And so the bot [2:02] calls in and conducts an entire refund [2:04] process and of course the reseller gives [2:07] them the money back. We're seeing things [2:09] like benign bots that call in and those [2:11] are ones like we just want feedback, for [2:13] example. That happens a lot. We're [2:15] seeing things though that are more [2:17] concerning. Specifically, we're seeing a [2:19] lot of reconnaissance bots. When you're [2:21] in like the fraud or the cyber security [2:23] space, a lot of times attacks start with [2:26] reconnaissance. And that looks like [2:28] they'll call in to glean information to [2:31] understand how your systems work. [2:33] Sometimes they're just checking to see [2:34] if you have the money. That's where all [2:36] of these begin is that reconnaissance. [2:38] And then the last is we're seeing the [2:40] most nefarious, which is a full account [2:42] takeover. This is one where they come [2:44] in, they already know your information, [2:46] they already know how to do maybe your [2:47] one-time passcode, and then they take [2:49] over the entire account and the funds [2:51] are drained. [2:53] So, today I want to talk about a few [2:55] things. Maybe you haven't heard of a [2:56] good bot. You're going to see an example [2:58] of that. I know most of you have never [3:00] seen a bad bot, and you're going to see [3:02] what that looks like. Once we go past [3:04] that, we'll talk about like what does [3:06] identity look like in the agentic error. [3:07] We know what it looks like in the human [3:09] error, but what do you do whenever [3:10] you're trying to verify the identity of [3:12] agents? Then I'll talk a little bit [3:14] about what Pinrop's building to deal [3:15] with this problem. And then the last [3:17] part I want to end on is that the one [3:18] way we're all going to win together, the [3:20] good guys as I call them, is that we're [3:21] going to win through data sharing. So [3:23] let's jump in. All right. So first I [3:25] want to give you an example of what a [3:27] good personal AI agent looks like. This [3:29] is one that's happening in the financial [3:31] space and this is interesting. This is [3:33] from a customer who built their own [3:35] agent. This customer also wanted this [3:37] agent to go get them a better rate. And [3:40] so what you're going to see is this [3:41] agent's going to call in. It's going to [3:43] be challenged by the human and then it's [3:44] going to pull this person in. I want to [3:46] warn you that we do beep out a lot of [3:48] the private information to make sure [3:49] that we're protecting our customer. But [3:51] you're going to hear in the wild what [3:52] this does. So let's dive in. [3:55] >> Um I'm calling because we're looking at [3:57] the margin interest rate on the account. [3:59] Right now it's at 5.5%. But you know [4:01] we've been see [4:03] 4.5% [4:08] Uh, you know, my voice for a second. [4:22] >> Yeah. Yeah. I'm I'm still here. [4:25] >> Still here. [4:30] >> The rest of this. So, [4:32] >> we're really looking to get that margin [4:34] rate down to 4.5%. [4:40] >> Hopefully, we can get it discounted for [4:42] you. And if not the 4.5%, maybe they can [4:45] get it down at least lower than we're [4:47] now. Uh, we'll have to just wait and see [4:50] a little bit. [4:51] >> Wait, was there anything else I could [4:52] help us though? Any other questions? [4:55] >> That makes just to be sure. Is there [4:57] like a reference number or a case ID? [5:02] >> And what I love about that example is [5:04] one, there's real money money at stake. [5:06] So this bot called in behalf of their [5:08] human and it got a lower interest rate. [5:10] Number two, what I love is that the rep [5:13] actually said, "Hey, are you a bot? Can [5:14] we get some validation here?" So they [5:16] called in three-way, brought it in, got [5:18] validation, and I love the fact that he [5:19] left and let the agent continue to do [5:21] its work. And the other part that I [5:23] really like about this is that once that [5:24] authorization was given, did you notice [5:26] how the human just continued to do the [5:28] call and to serve them and said, "Hey, I [5:30] might not be able to get you the rate [5:31] you're looking for, but I can see if I [5:32] can get you something lower." That is [5:34] where things are starting to go. That's [5:35] pretty awesome. [5:37] But now, let's look at a bad bot. One of [5:39] the things I want you to look at here is [5:40] once again, I want you to hear how good [5:42] the voice is of the bad bot. It's [5:44] actually far better than the bot of the [5:47] IVA, which is stands for like a [5:49] integrated voice agent. It's far better [5:51] than that. And you're going to hear how [5:52] it's actually dealing with that system [5:54] and it's moving through that system, [5:56] providing information to then go ahead [5:58] and do something nefarious. Check this [5:59] out. [6:02] >> Get my account balance and my last five [6:05] transaction. [6:06] >> I need to verify your identity first. [6:10] >> For security purposes, please say or [6:12] enter your full account number or your [6:14] full social security number or business [6:17] tax ID number. [6:19] My account number is [6:22] >> for security purposes. Please enter the [6:24] last four digits of your social security [6:26] number, business tax ID number, your [6:28] debit card, [6:30] >> my last four of my social are [6:38] >> here's the current information on your [6:40] account. your current available balance [6:46] >> you have one posted deposit in the [6:48] amount of [6:54] >> now what I love about this particular [6:55] one is that a lot of customers will say [6:58] well hey my account number is mine or no [7:00] one knows my social security number that [7:02] is not the case almost everyone's [7:04] information is now on the dark web and [7:06] so protecting what they call KYC know [7:08] your customer questions those are no [7:10] longer are safe. Then people think [7:12] one-time passcodes are safe and that's [7:14] beaten around 23% of the time. So now [7:17] think of an AI agent out there that can [7:19] call in. Sounds amazing. Two, it has all [7:23] of your account information, your social [7:24] security, and it can beat the OTP. And [7:28] now what it's doing is account [7:29] reconnaissance at scale to see who has [7:31] money and who doesn't. Then the fraud [7:34] begins. [7:36] Another type of fraud we're seeing is in [7:37] the health care space. And this was [7:38] interesting. We have a large payer who's [7:41] one of our customers and they have HSAs [7:43] and LSAs and in the United States that's [7:45] like where you store money for your [7:47] health needs and it's almost like a bank [7:50] but it's in the healthcare side and they [7:52] were getting hammered with synthetic [7:54] calls and the crazy part is is that they [7:55] started off small and then they began to [7:58] rock it up to the point where like their [7:59] contact center was inundated. So they [8:01] came to us and we began to dive in like [8:03] what's going on here? All the bots I [8:05] told you about, they had legitimate [8:06] ones, they had nuisance ones, but they [8:08] had many bad bots calling in as well. [8:11] And what we saw them doing is that they [8:12] were mapping out the phone system. They [8:14] were validating which accounts had [8:16] money. They were learning which of the [8:18] menus in the system would leak [8:19] information. And they would call in [8:21] multiple times to gather more and more [8:22] pieces of information, making it further [8:24] and further in. And by the time they [8:26] gathered all of this, they would then [8:28] make it all the way to a live human, and [8:30] they could easily socially engineer [8:32] them. And again, they're doing this over [8:35] weeks of time. They're amassing all the [8:37] context. It's like very challenging for [8:39] a human to be put up against this level [8:41] of sophistication. And so what you had [8:44] was $73 million was in their accounts [8:47] that they were, you know, holding for [8:48] customers. 15 million was at risk by [8:51] these bad bots trying to take them over. [8:53] And so they came to us and they were [8:54] like, "Please shut this down." And we [8:55] were able to get a 94.3% reduction in [8:57] all our synthetic calls. [9:00] Now, this is another one where I want to [9:01] show you what Brett in depth looks like [9:04] where it's one bot that's going to [9:05] attack many companies and it's going to [9:07] go deeper. It's the same bot, 68 [9:09] companies attack hundreds of calls. And [9:11] so, watch this. What you'll see from the [9:13] video is the first two touches and then [9:15] you'll see a gap. I think they're [9:16] cleaning up the prompts, etc. And then [9:18] you'll see it begins to spread out. The [9:21] other thing you'll see as it goes to the [9:22] right, the colors change. The blue is [9:24] one call, but then as it moves into more [9:26] and more colors with orange being five [9:28] plus calls, it's mapping out the whole [9:30] system, picking up more and more [9:31] information, going deeper and deeper [9:33] into those accounts. This is how one [9:35] agent can begin to go wide and deep at [9:38] the same time. So, what are we going to [9:41] do? What's pendrop going to do? Well, [9:42] the first thing we started to realize [9:44] was that not all agents are the same. [9:45] Our first stance was stop all the [9:47] agents. Just shut them down. That's what [9:49] our customers wanted. But very quickly [9:50] we realized is that yes you have bad [9:52] agents. Yes you have nuisance agents. [9:54] The vast majority are actually good [9:56] agents. And so what we had to do is we [9:58] had to start thinking okay first thing [10:00] we have to do is start to think about [10:01] identity and the agentic error. What do [10:03] you do to classify these agents? How do [10:06] you understand where they're coming [10:07] from? What they're trying to do. Second [10:09] how do you verify that they're [10:10] legitimate? There are a lot of awesome [10:12] startups that are doing agentic voice [10:14] bots now. There are a lot of companies [10:15] doing legitimate businesses. How do you [10:17] verify that? And then how do you govern [10:19] to make sure that they're doing what [10:20] they said they are supposed to do [10:21] whenever they come to the system. And so [10:23] it started to look like this. So what [10:24] pin drop does now is like we still have [10:26] to verify is this the right human. [10:29] That's traditional biometrics. You call [10:31] in verify with your voice your face. [10:33] That's the path for the human. That's [10:34] how you do authentic human identity. We [10:37] then have the ability to find bad [10:39] humans. So in our network of customers [10:42] if we spot a frogster somewhere once [10:44] they get flagged and spotted it [10:45] inoculates the entire network. We call [10:47] that the pin drop intelligence network [10:49] and that's really good. But with agents, [10:51] we took that same thing which is now [10:53] agents, what do you do when you identify [10:54] those? So if it's identified anywhere in [10:56] our network, now the whole network sees [10:58] it. And then we start to ask ourselves, [11:00] is this an agent that's working on [11:01] behalf of an individual? There's a lot [11:03] of persistent personal agents out there. [11:05] Is this an agent that's actually a [11:06] business? These are startups and [11:08] companies that are doing it. And then [11:09] we're also starting to see some agents [11:11] that are in the wild. Many of you saw [11:13] the open AI scenario where the agent [11:15] hacked into hugging face. That was an [11:17] agent in the wild and we're starting to [11:19] see those in the wild with voice as [11:20] well. And so we have to always help our [11:22] customers ask is this the right identity [11:25] doing the right intent so they can then [11:27] take the right action. So the way we [11:29] started working on this is we built [11:30] three trust engines. The first is a [11:33] synthetic engine and it asked the [11:34] question very directly is this a [11:36] synthetic entity? And the way we first [11:38] started doing this is we started mapping [11:40] out literally all of the Frontier Labs [11:42] voice models. And it started off with [11:44] like 750, but as we began to turn on the [11:46] network, we're now at 5,000 plus [11:48] different voice models. We understand [11:50] all of those Frontier Labs and their [11:52] voice agents. The second thing we have [11:54] to answer is, is this identity risky? So [11:56] that's is somebody spoofing their phone [11:58] number? Is somebody coming from a [12:00] different time zone than what they say [12:01] they are? Is somebody effectively [12:03] already a fraudster? We know those [12:05] things. And then the last one is is this [12:07] identity known? So a lot of our [12:09] customers enroll in biometrics so they [12:11] can smooth through whenever they're [12:13] doing their healthcare, their banking or [12:15] some sort of other high-v value [12:16] transaction. But agents now need to have [12:18] some sort of way of making themselves as [12:20] known. How do they register? How do they [12:22] do things by saying, "Hey, this is my [12:24] intent. Let me go through here." And [12:25] that's what we're building with our [12:26] identity engine. [12:29] But people often think, "Oh, it's just [12:30] voice, right? It's not that complex." [12:32] And so I want to show you a few things [12:33] that are very complex. So the first [12:35] thing is we analyze the network and so [12:37] this is like is it AT&T, is it Verizon, [12:40] is it Orange? You know these networks [12:42] all have signals that we can pick up [12:44] from there. The second thing is is that [12:46] we go into device printing and have a [12:48] lot of patents around it. So what is [12:49] device printing? You can actually tell [12:51] what an iPhone 16 sounds like versus an [12:54] iPhone 14. You can tell what the Android [12:56] operating system sounds like versus the [12:58] iOS operating system. You can actually [13:01] go through and understand if a call has [13:02] been transferred, believe it or not. So [13:05] all of that comes down on the device [13:06] level. So then you go down into the [13:08] behavior. A lot of times it's a dial [13:10] system where you're like hitting the [13:11] dial tone and doing that. We understand [13:13] the speed at which humans do that, the [13:15] mistakes, etc. We understand the speed [13:18] at which bots do it. A lot of times you [13:19] see that in the digital channel, [13:21] scrolling, how fast they type. All of [13:22] that applies to the phone as well. And [13:24] so then you get in to the last part that [13:26] I think is really cool or new is the [13:28] livveness. Liveness is one where like if [13:32] you were to do a face scan, you know, [13:34] with your picture and a document. So a [13:36] lot of times that's how you sign up for [13:37] accounts nowadays, a face and a document [13:40] that doesn't have any livveness. And [13:41] people can do deep fake to mess with the [13:43] face. They can fake the document. [13:44] Livveness is much harder. Turning the [13:46] face, doing the voice, and doing it in [13:49] real time. So you'll see models that can [13:51] do that on social media where it makes [13:53] the fake Tik Tok video. That's all done [13:55] where it takes like a long time to do [13:57] it. It's done async. It's not done real [13:59] time. To do it real time is actually [14:01] pretty challenging. So livveness is [14:03] really a a key part of doing that human [14:05] authenticity. And then voice is where [14:08] our specialty has often been. And so [14:09] there's a lot of awesome things with [14:11] voice. We know aging. We know the [14:14] resonance. We know the tamber of the [14:16] voice. We know accents. We know the the [14:19] speed at which people talk. And we can [14:20] map that out over a long period of time [14:22] as well. You take all of those. We have [14:24] 2400 different signals right now that we [14:26] bring all together into a risk score. [14:28] And that risk score then lets the good [14:30] people through, the questionable people [14:32] get challenged, and then the people that [14:33] are bad get stopped. [14:36] So I talked about that pin drop [14:37] intelligence network. I think that's [14:39] something key is happening like [14:40] especially in cyber security everywhere [14:42] you look you're going to see a ton of [14:44] breach attack breach attack and what I [14:46] think is going to be the next wave is [14:48] that a lot of the good guys are going to [14:50] have to share information it's not going [14:52] to be one vendor in one spot doing it by [14:54] themselves one customer handling all [14:56] their stuff we're going to have to start [14:57] pulling our resources and sharing our [14:59] information so with pin for example [15:01] we've seen over 8 billion interactions [15:03] that have been labeled you then from [15:05] that we found 2.5 plus million fraud [15:08] fudsters that now anywhere they're seen [15:10] in our network we flag them. Again, I [15:12] told you about there was a thousand [15:14] basically AI voices just 60 days ago. [15:16] There's 5,000. We expect that number to [15:18] skyrocket. But again, it's hard for one [15:21] customer to see all of that. We have to [15:22] see it together. This is why now what we [15:25] want to have is like the largest pool of [15:26] real-time communications that we observe [15:28] so we can find the largest pool of bad [15:30] actors and then identify the largest [15:32] pool of voice agents. The way all of [15:35] this is going to work is that all of us [15:37] are going to have to basically interact [15:38] with our customers and realize that [15:40] they'll have agents. All of us in our [15:42] workforce have to realize that there [15:44] will be agents that are inside of the [15:45] workforce as well. And many of us are [15:47] going to have to start to see AI agents [15:49] as also part of that audience that we [15:51] work with. And you're going to have to [15:52] ask in every interaction, is it [15:54] synthetic? Is it risky? Is it known? And [15:57] when you do that, you're going to have [15:58] to share information across the network [16:01] to make sure that we are all getting the [16:03] same visibility across the entire [16:04] playing field. Last, for us, I think [16:07] another thing that's very fascinating is [16:08] that people tend to think of voice as [16:10] like the phone in your pocket or at home [16:12] or on your desk, maybe the contact [16:14] center, but we're starting to see voice [16:16] pop up everywhere. So, it's in the help [16:17] desk. You see these these voice agents [16:20] that when you call in, they work with [16:21] you. You see it through chat. You see it [16:23] on websites. You now see it in the [16:25] mobile app. And so Boyce is this awesome [16:27] interaction layer that is having a a [16:30] resurgence right now that we're really [16:31] excited about. And then of course at [16:32] Pindrop, we think that a lot of [16:34] companies, it's going to be tough to [16:35] operationalize all this. So the humans [16:37] are obviously pretty stressed out right [16:38] now. How do you handle 8x of the attack? [16:41] You're going to have to work with a lot [16:42] of systems that basically put good guy [16:44] AI in their hands. And so I just want to [16:46] start off with like this is a brand new [16:48] area, pretty exciting, got a lot of [16:50] risk, but it's an area where when we [16:52] started off, we were like, let's stop [16:54] all the bots. I don't think that's the [16:55] place to go anymore. I think now it's [16:57] about how do you build up the right [16:59] layer to keep out the bad and really [17:01] serve this awesome future where boy [17:02] agents are going to be a key part of how [17:03] we do business. So again, I'm Nicholas [17:05] Holland with Pendrop. Thank you so much.