(Editor’s note: This is the 45th installment of a monthly column on the growing number of cyberthreats facing businesses of all sizes and what they can do about them. See previous installments here.)
Let’s get real for a second. As business leaders, we know how to manage risk. We review the balance sheet; we look at our supply chain; and we analyze the competitive landscape. But there is a business risk that is moving so fast, most executives can’t keep up. It’s affecting businesses’ financial and reputational risk.
We’ve seen a huge shift in the quality and accessibility of “synthetic media,” which is often referred to as "deepfakes." This isn't just about innocent face-swapping apps anymore. We’re talking about high-quality, AI-driven impersonations that mimic an executive’s voice, mannerisms and even their decision-making.
Business leaders need to understand that physical identity can now be weaponized. This is not a "tech problem," it’s an advancing scene of financial, reputational and operational risks for organizations.
For a while, you could spot a deepfake if you looked close enough. Maybe the lips didn’t match the words, the eyes didn’t blink right, or the audio quality felt a little off. Now the technology has matured and become readily available. We’re seeing real-time video generation where an attacker can hop on a Zoom call, use a digital overlay of your face and interact with your team.
We’ve already seen the damage. Just look at the 2024 case of the multinational engineering firm Arup that lost over $25 million in a single afternoon. A finance clerk was pulled into a video conference with what he thought was the chief financial officer and other colleagues. The meeting was an AI-generated master class designed to authorize fraudulent transfers. Since then, the barrier to entry has disappeared.
High-quality deepfake videos that once needed expert skills can now be purchased for as little as $5. Because of this, deepfake fraud cases have risen 3,000% since 2024. There was $1.65 billion in losses reported in 2025 alone.
So, how can we fight back and limit our exposure?
First, you can have “out of band” verification processes in place to confirm identities and transactions. If a request involves moving money, changing credentials or accessing sensitive data, you need a second and nondigital step. This is a human-to-human verification. If the CFO asks for a high-dollar transfer over a video call, the policy must kick in. The employee must hang up, call a verified pre-established number and get a verbal confirmation code. We have to go "old school" to beat the high-tech risk.
To minimize personal risk, executives might want to think about limiting their digital footprint. The more high-quality photos and videos of you that exist online, the easier it is for AI to learn your likeness. Change your social media accounts to private and regularly review who has access to your posts.
Security awareness training for staff needs modernization as well. Not only teach people how to spot a fake but teach them to verify the intent. If a request feels urgent, out of character or bypasses normal checks and balances, it should raise a red flag. We need to encourage employees to take a pause and verify, without fear.
As part of emergency response tabletop exercise plans, have a deepfake scenario. Run these exercises with the board and executive team included. Build muscle memory on how the organization would react to a deepfake attack.
We are now entering a phase where we must secure our very own physical identities. When a threat actor can fabricate your presence and bypass technical security controls, the risk is no longer fixed by a piece of software.
True resilience requires us to move beyond "seeing is believing" and add procedural verification. Ask yourself this: if your likeness were used tomorrow to authorize a decision that could be catastrophic to the business, would your processes be strong enough to catch it?
Next month: Lessons learned from the Canvas breach.
Jason Albuquerque is the chief operating officer of Pawtucket-based Envision Technology Advisors LLC. You can reach him at www.envisionsuccess.net.
