Trust, Verify, Repeat: Securing Healthcare in the Age of AI Voices

Narrator: Welcome to the Cybersecurity at Vive series on the Beat podcast where we break down the fast moving world of cybersecurity and what it means for your healthcare business, your data and your everyday life. In this series, we'll go beyond the headlines to explore real threats, real defenses, and the people on the front lines keeping our digital world secure. And now your host, Sandy Vance.

Sandy Vance: Hey everybody. Welcome back to the cybersecurity adv uh series on the Beat podcast. I'm your host, Sandy Vance and today I'm here with Jason Barr, who is the VP of healthcare at Pindrop. Welcome back to the show, Jason.

Jason Barr: Thanks, Sandy. It's great to be back.

Sandy Vance: So Jason helps organizations defend against AI driven fraud and rethink identity in a world where even a human voice can no longer be trusted. And I guess we could start with, for listeners who may not be familiar with pin drop, how would you describe what you do and why has voice become such a critical and vulnerable layer in cybersecurity for healthcare?

Jason Barr: Let me start with a quick history lesson. So pindrop started about 15 years ago. Our CEO Vijay is a PhD and he wrote the book on how to improve voice recognition, biometrics detection, authentication as his dissertation. And 300 and some patents later. And all of the largest organizations across finance, insurance and now retail and health care have leveraged pin drop to defeat the outdated tactics like knowledge based questions or one time passcodes that bad guys have come to figure out how to defeat. And so there's really three steps to creating trust. And it started in banking and finance because bad guys are lazy. So they're not necessarily stupid. They're lazy. And so they go after easy money. And if you think about banking, if I can get through the authorization process, I can get access to money. And they had to do this by picking up the phone. Now, you know, flash forward 15 years and the last two years of AI explosion. With tools and better synthesis and synthetic voices, they can now attack health care at scale where instead of having a room of 20 bad guys picking up the phone and trying to get cash, they now have an AI machine. They download dark web data, they upload it, they train these machines and they can do 4,000 calls a day. And people, the next question that I typically get is why would you attack healthcare through the phone? And what's even scarier about bad guys coming through the voice channel is healthcare has done a terrific job focusing on digital security, digital identity, but the voice has always been a service channel and AI has so rapidly changed the it into A threat vector over the last two years that it's really hard to, one, detect you're talking to a bad guy or a synthetic voice. And two, a lot of the fraud that they're doing in healthcare is reconnaissance. So they're collecting phi, they're collecting addresses. And which insurance provider did you go through for this claim? So that they can then use that data and go attack payers and pharma and redistribute pharmaceuticals and reroute claims and reimbursements and things like that.

Sandy Vance: Yeah. So, you know, we're at this point where the concept of trusting a voice is no longer, you know, it's just, it's no longer working. And I think AI has obviously played an enormous role in that. But, you know, how are we going to fight this fight? How does pin drop sort of use? I mean, I don't know. I think you talked a little bit at Vive maybe about using AI to fight AI and how you guys are leveraging some of these more advanced tools to get in there and detect threat.

Jason Barr: Let's start with continuous identity, and that's a new framework. Typically, security on the perimeter is about identity. And once I claim and then get authenticated to I am who I say I am, I can go anywhere inside the wire, so to speak. But, uh, in this world, you need to continuously identify someone. Just as an example, we have people that have paid other people to get a job somewhere, get through the hiring process, and then give the bad guy credentials for money. And so now you think you've got Sandy working at your organization, but it's really bad guy Bob, and he's doing all kinds of things from inside the wire, which is really dangerous. And so the same is happening on all these voice channels in that our proprietary technology has behind it a team of researchers that work with the AI ecosystem. And we're constantly looking at, you know, what's different this week or this month? Because it's, it's, it's evolving that fast, and they go out and figure out what are the underlying signals and data and behaviors and patterns and devices that are out there on the market the bad guys are going to leverage. And I'm talking platforms that you recognize that you could download for $5 a month, and you see them on the news doing deep fakes of celebrities and different things, and it's more fun and entertainment. But bad guys are utilizing these things at scale against organizations to cause harm, financial loss and disruption.

Sandy Vance: Yeah, I think we've all seen these examples. And as the commercialization of AI has become more prevalent. Like there's so many tools now and people can just do anything with it. So what are sort of the things that you all encourage or, uh, the use cases? I would say the specific risks that you guys are working with healthcare organizational leaders to watch out for. Like how are these tools being leveraged against healthcare organizations?

Jason Barr: They basically fall into doing three major things. One, it's authentication. And we do that by converting the voice into a mathematical algorithm that is proprietary to us. And when that person comes through a phone line, we can with very high certainty say, that's Sandy. So that's check number one. Number two, getting into the continuous, we're looking at 16,000 signals in that data. So suddenly Sandy's IP address or spoofing detection or device or behavior looks off. We will flag that risk. And then our customers decide, do I kill this call, do I cue this call, or do I escalate this call to an agent? And then on the liveness side, we have a platform that looks at, is this a synthetic voice, Is this synthetic video? So it answers really, is this the right person? Is this a bad person? And is this a real person? And so together, those three signals go hand in hand to help organizations solve problems. Like the biggest one we're seeing out in the market is bots. Bots are now calling on behalf of patients, providers and organizations. So think about the prior auth process and how many hours humans have spent on the phone trying to adjudicate prior auth claims and get them through, get them followed up on, get them paid. And so now bots are doing that. And that's great, that's great for everybody, because nobody wants to do that. And really, if we had a perfect infinite OpenAI world, we could do that all through data exchange and logic. But that doesn't exist. It's been in progress for what, 20 years now. And so the phone lines are heavily used there. Well, the payer organizations are still governed by the existing regulations. And their first question is when they detect a bot, and usually it's by human ear, which can only detect synthetic voice about 30% of the time. So they get it wrong 7 out of 10 times.

Sandy Vance: Great.

Jason Barr: When they hear something funny, they go, wait a second, this sounds synthetic. I can't give phi to someone if I don't know that they're authorized to or have that delegated authority to act on behalf of that practice or that patient. And we're seeing just thousands and thousands of bots flooding the market. And we're just in the early days. And so that's one use case.

Sandy Vance: So the bots are calling health care organizations posing as the patient in this situation or as a provider, or as what? Like what is the typical sort of destructive use case.

Jason Barr: So there's good bots and bad bots. Let's make that clear. So when I talk about, you know, the prior auth scenario, the good bots are out there so that providers and insurance teams don't have to stay on the phone for hours at a time figuring these things out. The bad bots are taking advantage of that and they know that that's happening. And so they. You can't tell the difference between a good bot and a bad bot today. That's step one. Step two is, what are the bad bots doing? Well, we've actually heard from customers where they had a repeat caller. They asked all, they went through all of the authentication questions. They then turned around, deep faked the organization and called the patient to get all the answers. Hi, Sandy, this is me from Acme Health. You know, can you tell me what your birthday is? You know, and so people are answering these questions. They then turn around and come back with the voice of the patient. Get through, then do that reconnaissance, do that destruction, commit that front.

Sandy Vance: What types of organizations are you guys working with? Is it large providers? Payers primarily. Like, who are you guys working with?

Jason Barr: We're working with payers, providers, pharma, PBMs, RCM, um, health tech. It's anyone that has this liveness channel, this phone or video that has for the first time in the history of mankind, ever had to wonder, am I talking to a real human? And what we're seeing especially disturbing is there are nation states that are attacking U.S. organizations. And they, they will get in through the hiring process, deep faking themselves or using a proxy and then getting those credentials. And then they're in. We had an organization turn on our, what's called Pulse for meetings. It plugs into Zoom or, you know, webex or things like that. And it'll notify the host. I detect synthetic voice or video so that you can stop, uh, call, shut it down, and then hand to security when they turn this on. They found multiple dozens of synthetic workers inside the wire. And if you talk to CISOs anywhere across the industry, they're aware of this. And the tools to do these things were usually a patchwork of a lot of different policies and processes. And here it's simply install that into your virtual meeting platform and you've just shut down a whole avenue of bad guys to do harm inside your organization.

Sandy Vance: Wow. It reminds me of like when, when Covid, uh, shut everything down and kids were getting on these zoom calls at schools and they were finding all kinds of bad actors entering the zoom calls, and it was just wide open. But to think about that happening within a provider organization where in theory, you know, they're all on an internal zoom line, but with role based access, you know, if you get uh, a bad actor through the process, they flip a switch and bam, they're into everything.

Jason Barr: That's right. It's frightening how much this has happened and the scale at uh, which this has happened and the growth at which we're seeing it just over like the last 12 to 24 months. So, you know, we've got a graph where like two years ago there were like 100 AI tools on the market, and today there's like 1800. And that's from like six months ago. And so this explosion of tools has basically destroyed the attacker's cost curve. It's now infinite to scale, very cheap and very effective. And you know, the cyber professionals teams that we work with aren't even aware that some of these tactics are out there in the market. And as pervasive as they are, because it's happened so fast, what areas of

Sandy Vance: the business are seeing the majority of these issues?

Jason Barr: Sure. So on the patient contact center, you know, you just see these probing, reconnaissance attacks on the provider call lines. You see some manipulation of the pharmaceuticals and orders. But what a lot of people have looked at over the last couple of years is digitally fortifying the help desk, because the help desk is access into the systems. If you can steal someone's credentials. And credential theft is one of the most successful tactics to really cause damage. And so what does a bad guy do? He doesn't go through the digital reset process. He picks up the phone and says, hi, I'm Dr. Barr, I've lost my phone, my computer's at home, I'm going into surgery and I need to be reset now. And puts pressure on that agent. And so there's all kinds of different tactics and techniques that some of the more advanced healthcare organizations have deployed over the last couple years. Like, let's jump on a zoom, hold up your badge. AI deepfakes can do that now. And so you can't believe your ears and your eyes because the tools are good enough that your agents will be faked. And so it's much better to look at when you come into that system. First authenticate on the voice, then detect on the threat signals then check liveness. And if all three of those things exist, an agent with much less stress has the ability and the authority and the clearance to go ahead and reset these credentials, even in nonstandard ways, when most CISOs will say, shut down the phone line because it's just not secure. But that, that just can't happen yet.

Sandy Vance: What do you think the future holds? Are we going to basically use tools like pin drop to make voice more secure? And, you know, is, is this technical capability advanced enough that we'll be able to really come to rely on this as a method of identifying a person, or do we move into, uh, an era where voice as trust is replaced with something else?

Jason Barr: I think that's a great question. And in this rapidly evolving world, with the technology developing and evolving the way it does in weeks and months, not years and decades, I don't know what the future looks like. But what I can tell you in the short term, right, is most of us are not going to want to talk to AI or a robot if it makes any mistakes and it can't help us. Get me to a human. I want somebody who can connect with me, understand my frustration, solve my problem someday. That might not be true, but for, I don't know, the foreseeable future, we now have to install these mechanisms to make sure that we're talking to a human, we're looking at a human, whenever we're not standing in front of a human.

Sandy Vance: Yeah, absolutely. So you presented at Vive a case study. Do you want to talk to our audience a little bit about some of the metrics that you guys were seeing? Did you present an implementation?

Jason Barr: Yes. So one of the largest, if not the largest HSA in the country, Health equity, very forward, fast moving leading edge head of fraud, AI and trust came from the banking world. So he had seen these tactics in their infancy. And when he moved over he was like, we don't have anything to detect people coming after these funds. Like we need to do something. And so they were seeing extraordinary amounts of synthetic and fraudulent attacks. They implemented pin drop and three things happened that blow my mind. I mean, I'm not making this up. We've got published case studies to this. Their head of fraud, AI and trust. Ajit is awesome, talks for us all the time. He saw a 90% reduction in fraud. He saw the operational cost go way down because agents weren't wasting their time talking to bad guys or escalating calls or talking to bots, which typically increase the average handle time or the Talk time by 3 to 5x, which is, you know, time is money in that world. And the third thing was our customer satisfaction scores went up.

Sandy Vance: Wow.

Jason Barr: So it, uh, reduced the friction for the customer side because with our passive voice authentication, you don't have to ask Sandy five questions about who you are every time you call. And you might be working on an issue. And call three or four times in a week or two. And now you can just say, I'm Sandy Vance. And with two seconds of speech, we can say with high certainty, this is Sandy, let's let her in. But we're going to continue to monitor that for any of those other signals that I talked about. And so now their agents turnovers down because they're less stressed about giving the wrong information to a bad guy. And they can see right on their screen, risk detection here is low. Continue with your call. And when it's high, it doesn't even get to an agent. So we actually live at the genesis of the phone call into these contact centers. So the IVR is already detecting it. And so it won't even make it to the iva, the agent leg, and then it won't make it to the human leg. If we see any of these things, we're monitoring in real time the whole time.

Sandy Vance: So we'll definitely link to. I know there's a recording of that case study out on the health platform. We'll be sure to link that so that our viewers can find it before we part. Jason, do you have any words of wisdom or advice to health care leaders who maybe have not implemented something like this that can overlay their voice calls for security?

Jason Barr: What we're seeing right now is a lot of boards are seeing the news and seeing the trends and they're coming back to their leadership and saying, are we protected on this front? And a lot of leaders are aware of the tactics and techniques that bad guys are using AI for. What they don't recognize, because this is a new thing, is the rate at which these attacks have exploded just off the charts. 1300% increase in the last year in AI enabled attacks. And it's getting bigger every year. It was 1,200% the year before. And so, and it was like 300% before that. So you're just seeing this logarithmic scale explode, these attacks, because again, the cost curve has collapsed. And so I think it's really important for them to talk to their agents and their call center operations who aren't typically in the CISO team conversations or the CIO and identity team, because you know, the boxes have been checked about complying with regulations and the challenge questions and the tactics that worked just two, three years ago. And so talking to them and saying, what do we think we see? And if you hear, I don't think we have a deep fake problem, the question you should ask is, how do we know? Because they've gotten so good that again, humans can only detect it less than half the time. So it's really looking at that, thinking about that service channel, thinking about the cost and the security elements and going back to that story with a JIT. Right. 90% fraud reduction, decrease in operational cost, increase in customer satisfaction. So that's a pretty interesting trifecta for a platform to deliver. And our CEO gets all the credit for that, writing these protocols and developing these policies for 15 years in the most attacked sector in business or corporate world. So we've learned our lessons, we've seen the tactics change, we change with them very rapidly. And a year from now when we're talking on this, there will be a whole new wave and a whole new angle of leveraging AI for attacks because it's just going to continue to change that fast.

Sandy Vance: Yeah, I think the key here is everyone's got to have the right partner to protect them against these things. How can folks learn more about working with pin drop?

Jason Barr: Yeah, check us out at Pindrop. Uh, dot com. I'm posting constantly on LinkedIn, Jason Barr, and every time that I see the market move like aha, ama, FBI, cms. It's not the headline yet, it's the undertone because there's lots of other security problems that AI causes as well. We've all heard of Mythos and all these vulnerabilities and that's making the headline and the bad guys love that. Sure, go focus on that stuff. What I'm going to do is I'm going to attack the vector that's least protected and I don't have to worry about extra effort or extra cost. I can do it while I'm sitting at the beach or a coffee shop because my agentic bad guy platforms are doing this for me.

Sandy Vance: We'll be sure to link to your LinkedIn in the show notes as well. I so appreciate your time today.

Jason Barr: Thanks so much, Sandy.

Narrator: Hey, if you enjoy listening to this podcast, be sure to check out all the content around data innovation at 52026 by visiting health.com that's HLTH.com from there go to the Events tab and you will find recordings of nearly 100 case study presentations podcasts like this and white papers presented by leading technology solution providers. Be sure to subscribe so that you don't miss the next VIVE event presented by Health and Chime.