Two years ago, I sat across from a chief financial officer who had just spent forty minutes on a video call authorizing what he believed was a legitimate acquisition payment. The call included his CEO and two board members, all speaking in familiar voices, all making the kind of small unscripted comments that make a meeting feel real. None of them were real. The audio had been cloned from earnings call recordings, and the video was built from conference footage pulled off YouTube.
What gave it away wasn’t a glitch or a blurred hand. It was a . The CFO asked about a side conversation from the previous week that only the real CEO would have known, and the voice on the other end hesitated half a second too long before answering. That hesitation stopped a seven-figure transfer.
It also taught me something I have carried into every engagement since. Executive impersonation has moved from a theoretical AI risk category into an active enterprise security problem, and detection and response capability lags materially behind attacker capability.
When clients ask me what to buy first, I tell them to slow down. The tooling landscape for synthetic media is real, but it is not mature, and treating it as solved creates false confidence at exactly the moment confidence gets tested.
Audio and video forensics tools scan a file after the fact for artifacts synthetic generation tends to leave behind. They are genuinely useful in a post-incident review, where there is time to run deeper analysis. They are far less useful in the middle of a live call, where a decision has to get made in seconds rather than hours.
Liveness detection tries to solve that timing problem by checking for signs of life during the interaction itself, rather than analyzing a file afterward. The trouble is that these systems were mostly built for identity verification at onboarding, a single controlled check at a fixed point in time. Retrofitting them into an unplanned executive call is still mostly aspirational, and most vendors will tell you the same thing privately even while marketing otherwise.
The MITRE ATLAS knowledge base, which catalogs real-world adversarial attacks against AI systems, now documents deepfake-based identity verification bypass as an established attack pattern rather than an edge case. That matters for CISOs because it confirms this is not a hypothetical gap security vendors invented to sell tools. It is a documented technique with case studies attached.
What senior executives specifically need, and what the market still doesn’t reliably offer, is verification that works in the moment a request is made rather than after the fact. Until that exists at scale, the tooling has to sit inside a broader protocol rather than stand in for one.
Tooling alone will not close this gap, so the operational framework matters more than any single product. Here is what I put in place with clients, organized around five actions.
Even programs built around all five of those actions still run into gaps that no enterprise has fully closed.
The first is the personal exposure gap. Most protocols assume the target is inside a corporate communication channel. Attackers are increasingly working the other direction, reaching family members or personal devices where none of the corporate verification steps apply at all.
The second is the public-facing gap. Livestreams of major corporate events have been hijacked by deepfakes of the company’s own executives, often promoting cryptocurrency scams, with fake feeds sometimes drawing sizeable audiences before takedown. That is not an internal fraud scenario a SOC playbook was built for. It is a brand and platform-level impersonation that needed coordination with a video platform in real time, and almost nobody has that relationship pre-built. The security team needing to reach a platform’s off-hours trust and safety escalation path in the middle of a live event is functionally starting from zero every time, and the incident is often over by the time the right internal owner on the platform side is even identified.
The third is measurement. Very few security teams can currently tell their board how prepared they actually are for this category of risk, because the tabletop exercises that would surface the gaps are still rare. Boards are starting to ask the question anyway, often after reading about another company’s incident rather than their own, and a security leader without a rehearsed answer is at a real disadvantage in that conversation.
Back to that CFO on the video call. What saved him was not a tool. It was a habit, built well before the attack, of treating a hesitation as reason enough to stop. That is still the most reliable control available, and it will remain the most reliable control until the rest of this framework catches up to it.