A Fake CEO Voice. A Real Cyber Threat. Lessons from IHCA's Healthcare Leadership Conference

A cloned voice opened a cybersecurity talk last week. Nobody in the room knew it was fake.

Celerium’s CISO, Vince Crisler was invited to speak at the Iowa Healthcare Association (IHCA) CEO + Senior Executive Leaders Conference in Iowa, a room full of senior leaders running long-term care and assisted living facilities across the state. The session was called “You’re a Target,” and Vince wanted the opening to prove the title before he said a single word.

So, with permission, he cloned Brent Willett's voice, IHCA’s President and CEO, using a few minutes of publicly available audio. The recording welcomed everyone to the session, introduced the speaker, and then, just to make sure nobody missed the point, it had Brent announce that all future IHCA conferences would include mandatory polka lessons and that Minions are real and amazing.

The room laughed. Then it got very quiet. Because if a presenter can fake their CEO’s voice convincingly enough to fool a room of executives, someone else can fake a call to a night-shift administrator requesting an emergency wire transfer.

The voice clone wasn’t the only demonstration. During the session, Vince showed an AI-generated wire fraud email targeting an Iowa long-term care facility in real time, written entirely by AI, and using publicly available information. The demonstration took two minutes from start to finish. The CEO and CFO of that facility were sitting in the room. The email was so accurate and so well written that the discomfort was visible. It named the right people, used the right language, and looked exactly like something that would land in an inbox and get acted on without a second thought. That’s not a hypothetical scenario on a slide. That’s a real facility, real executives, and a fake email that would have worked.

That’s the world healthcare leaders are operating in now.

A pre-session survey of attendees painted a stark picture. Only about 8% felt very confident their staff could identify a phishing email. Roughly 85% didn’t have a tested incident response plan. Budget and staff awareness are tied as the top barrier to improving security. Nearly 40% had experienced a cybersecurity incident in the past two years or weren’t sure if they had. These aren’t organizations ignoring the problem. They’re stretched thin and doing the best they can with what they have.

And the threat is accelerating faster than most people realize. Anthropic recently published research showing that their most advanced AI model, Claude Mythos, can take a publicly disclosed software vulnerability and produce a working exploit in hours, not weeks. Their red team’s own language: the concept of “N-day” vulnerabilities is now dangerously misleading. “N-hour” is closer to reality. In one test, working from compiled Windows kernel binaries with no source code available, the model produced multiple full privilege escalation chains in under a day.

That’s not a future problem. That’s now. And healthcare is sitting in the blast radius.

Healthcare is already the most breached sector in the economy. These organizations run massive footprints of legacy systems, connected medical devices, and vendor-locked software that often can’t be patched quickly, or at all. Anthropic’s own research specifically flagged medical devices as disproportionately exposed because of fixed maintenance windows and uptime requirements. When AI compresses the time between a vulnerability being disclosed and a working exploit being available, every unpatched system becomes a louder target.

And patching faster isn’t a realistic answer for most of these organizations. There were over forty thousand new vulnerabilities disclosed last year alone, before AI accelerated anything. The IT teams at most healthcare facilities are a handful of people doing everything from device provisioning to compliance. They don’t have the bandwidth to manage another complex security tool on top of everything else.

That’s the gap Celerium was built to fill. A vulnerability isn’t actually a threat until someone reaches it and exploits it. If patching can’t keep pace, and for most organizations it can’t, the answer is to stop the attacker before they ever reach the vulnerability. Disrupt the attack at reconnaissance and initial access, before exploitation ever happens.

Celerium’s Data Breach Defender® solution deploys in about thirty minutes. No hardware. No software agents. It integrates directly with the firewalls an organization already has, begins automated protection almost immediately, and reoptimizes defenses automatically every fifteen minutes. No dedicated security team required to manage it. It’s a model built for an organization with five people doing everything, not fifty people doing security.

This isn’t theoretical. Celerium spent over seven years building and operating this exact approach for the Department of Defense, protecting thousands of small and mid-sized defense contractors who face the same resource constraints as small and mid-sized healthcare organizations. The technology is proven at scale before it ever reaches a hospital’s front door.

The room in Iowa last week was full of leaders who care deeply about protecting their residents and their organizations. They’re not looking for a sales pitch. They’re looking for something that actually works within the reality of their staffing and their budgets.

Thanks to IHCA for hosting, and to Brent Willett for being a great sport about the voice clone.

Want to learn how hospitals are using Data Breach Defender®  to detect and contain data breaches before they escalate?