In today's AI-powered world, deepfake attacks are quickly evolving into one of the most dangerous forms of insider threat. These deepfake threats blur the line between genuine interactions and malicious deceptions. When the person on the screen looks and sounds exactly like someone you trust, your security perimeter may already have moved inside the organisation.

Imagine this.

You receive a video call from your CFO. The face is familiar. The voice is convincing. The tone is urgent. You are asked to approve a confidential wire transfer.

You hesitate for a moment. Then you comply.

Why wouldn't you? You just saw and heard your CFO.

Except you didn't.

The CFO never made that call.

This is no longer science fiction.  Recently, an employee at a multinational company in Hong Kong was reportedly deceived into transferring around US$25.6 million after joining a video conference in which the CFO and several other colleagues had been digitally impersonated. The employee initially had doubts, but the presence of familiar faces and voices on the call made the request appear legitimate. [Source: Hong Kong Monetary Authority / reported incident]

The incident exposed something security teams can no longer afford to ignore: a familiar face or voice is no longer proof of identity.

Deepfake technology has evolved from internet curiosity into a serious tool for fraud, social engineering and identity deception. And unlike traditional cyberattacks, these attacks may not need to exploit vulnerabilities in your network.

They can exploit something much more fundamental.

Trust.

That's precisely why deepfake security and insider threat protection have become a focus area companies can no longer afford to ignore. Before we explore ways to detect deepfakes, let's first understand what a deepfake is and how it is affecting organisations.

A deepfake is AI-generated or AI-manipulated audio, video or imagery designed to make a person appear to say or do something they never actually said or did.

The technology behind deepfakes has advanced rapidly. Generative AI can now reproduce facial movements, voices and expressions with increasing realism, making synthetic media harder for people to distinguish from genuine content.

Deepfake-enabled fraud attempts surged by more than 1,300% year over year. In fact, 1 in 10 adults globally has encountered an AI voice scam.  [Source: SQ Magazine]

Voice cloning is particularly concerning for organisations. Publicly available interviews, presentations, webinars and videos can provide attackers with material that can be used to create convincing impersonations.

According to a 2025 United Nations Office on Drugs and Crime report, some voice-cloning services have been able to generate convincing voice replicas from relatively short audio samples. The accessibility of these tools is lowering the barrier for attackers. [Source: UNODC, 2025]

That changes the risk equation.

An attacker does not necessarily need access to an executive's account. They may only need enough information to convincingly impersonate the executive.

The identity itself becomes the attack surface.

For years, security teams had a clear definition of insider threat in their heads. That definition has changed, and it's worth pausing to see exactly how.

Let's first take a step back and understand what an insider threat is.

Traditionally, an insider threat meant someone who already had legitimate access to an organisation and misused it.

That could be a disgruntled employee stealing data, a careless employee exposing sensitive information, or a compromised account being used by an attacker.

Deepfakes introduce a new layer of insider threat.

An external attacker can now attempt to look and sound like an insider without ever becoming one.

Consider a finance employee receiving an urgent payment request from the CFO. Or an IT help-desk employee receiving a call from someone who appears to be a senior administrator asking for a password reset. Or a recruiter conducting a video interview with a candidate whose identity has been manipulated.

The attacker may not have the credentials, authority or access.

They simply need to convince someone who does.

This is why deepfakes deserve to be considered alongside traditional insider-risk scenarios. The question is no longer only:

“What is this user doing?”

It increasingly becomes:

“Who is actually behind this interaction?”

The Ponemon Institute's 2025 Cost of Insider Risks Global Report found that the average annualised cost of insider-related incidents had risen to $17.4 million, up from $15.4 million in 2022. [Source: Ponemon Institute, 2025]

Deepfakes add another layer of risk by letting external actors manipulate the people and processes inside the organisation.

A deepfake attack rarely begins with the deepfake itself.

It often begins with reconnaissance.

Attackers can gather information about executives, employees, reporting structures, suppliers and business processes from public sources. LinkedIn profiles, company websites, interviews, conference videos and social media can all provide useful context.

The attacker then chooses the right person and the right moment.

Here are three increasingly common scenarios:

1. Executive Impersonation: CEO Fraud 2.0

The classic business email compromise attack is evolving.

Instead of sending an email pretending to be the CEO, an attacker can combine email, messaging platforms, voice cloning and synthetic video to create a much more convincing interaction.

The request might involve:

• An urgent wire transfer

• A confidential acquisition

• A request for sensitive documents

• A password or credential reset

• Access to a privileged system

• A request to bypass an established approval process.

The more channels the attacker controls, the more credible the story can appear.

The lesson is important:

A video call does not automatically make interaction trustworthy.

2. Fake Hiring: When the Insider Arrives Before Day One

Deepfake-enabled deception is no longer limited to financial fraud. Recruitment itself is becoming an attack surface.

In January 2026, Jason Rebholz, co-founder and CEO of AI security company Evoke, encountered a job applicant using a real-time deepfake during an interview for a security researcher role. The candidate’s face appeared blurred and unnatural, with visible glitches around the face and glasses. His responses also appeared unusually scripted, raising further concerns about the candidate’s identity. The interview was later analysed using deepfake detection technology, confirming the suspicion.

[Source: The Register, 2026]

The incident highlights an uncomfortable reality: even security-conscious organisations can be targeted through synthetic identities and manipulated video interviews.

The lesson is clear:

Identity verification cannot end when a candidate passes an interview.

For remote and hybrid hiring, identity needs to remain part of the security lifecycle from recruitment and onboarding to access management and ongoing monitoring.

3. Social Engineering Through Trusted Channels

Attackers are increasingly moving beyond email.

WhatsApp, Microsoft Teams, Zoom, phone calls and other collaboration tools can become part of the attack.

A particularly telling example involved Ferrari in 2024. An executive received messages and a call appearing to come from CEO Benedetto Vigna about a confidential acquisition. The caller's voice reportedly reproduced Vigna's accent convincingly.

The executive became suspicious and asked a simple question about a book the CEO had recently recommended.

The attacker could not answer.

The call ended.

It was a remarkably simple defence, but it worked because the employee did not treat the familiar voice as sufficient proof of identity. [Source: MIT Sloan Management Review, 2025]

That is the mindset organisations need to build.

Recognition is not verification.

Deepfake attacks expose a gap in many traditional security models.

Firewalls, endpoint protection and email security remain essential, but they are not designed to determine whether the person speaking on a video call is actually the person they appear to be.

Firewalls and endpoint security

The attacker may never touch the corporate network. The employee is the one initiating the transaction or sharing the information. The attack happens through legitimate communication channels.

Email security

Email filters can identify malicious links, attachments and suspicious messages. However, they cannot, by themselves, determine whether the voice on a subsequent phone call is synthetic.

MFA and authentication

MFA remains an important control, but attackers can target the human processes around authentication. A convincing impersonation may be used to persuade a help-desk employee to reset credentials or bypass an established procedure.

Video interviews and background checks

Synthetic identities, stolen credentials and AI-generated personas can also challenge traditional verification processes. Several such incidents are useful reminder that identity verification needs to be layered rather than treated as a one-time event.

The fundamental issue is simple:

Technology can verify a device, account or credential. Organisations must also verify the context in which trust is being exercised.

Yes, but detection should not be treated as a single silver bullet.

Deepfake detection is evolving rapidly, and organisations can use a combination of technical analysis, behavioural monitoring and human verification.

AI-Assisted Detection

Deepfake detection technologies can analyse audio and video for indicators associated with synthetic media, including inconsistencies in facial movement, lip synchronisation, lighting, image patterns and audio characteristics.

However, detection accuracy varies by technology, media quality and attack technique. As generative models improve, detection tools must continuously evolve.

That is why organisations should avoid building their entire defence strategy around a single detection engine.

Behavioural Anomaly Detection

Sometimes the strongest indicator is not the media itself.

It is the action that follows.

An executive who normally approves of routine expenses suddenly requests a large transfer. A user who never accesses a sensitive database suddenly attempts to download large volumes of information. A help-desk request comes from an unusual location and asks for privileged access.

User and Entity Behaviour Analytics (UEBA) and other behavioural controls can help identify these deviations.

The advantage is that the organisation does not need to perfectly identify the deepfake.

It needs to identify that something about the interaction does not make sense.

Out-of-Band Verification

For high-risk actions, organisations should establish a second verification channel.

If a senior executive requests a high-value transfer during a video call, verify the request using a trusted phone number already held in the organisation's records.

If someone requests a password reset for a privileged account, follow the established identity-verification process rather than relying on voice or video interaction.

The key is that the second channel should be independent of the original interaction.

Real-Time Detection

Security vendors are also developing technologies designed to identify synthetic audio and video during live interactions.

These capabilities can become another layer of defence, particularly for high-risk communications and identity-verification workflows.

But the objective should not be to replace human judgement.

It should be to give people more signals to make better decisions.

So, the real question is how do you protect your organisation from deepfake attacks? The answer is not another line item on a security budget. It is resilience, built deliberately across people, process, and technology.

To ensure effective deepfake protection, companies need to rethink how trust is established.

1. Extend Zero Trust to Human Communication

Zero Trust is commonly discussed in the context of networks, devices and applications.

The same principle should apply to high-risk human interactions:

Never trust solely because someone looks or sounds familiar. Verify before acting.

Employees should know exactly which requests require additional verification, particularly those involving money, privileged access or sensitive information.

2. Create Verification Protocols for High-Risk Requests

Organisations should establish clear procedures for unusual requests.

• High-value payments require independent confirmation.

• Privileged-access changes require secondary approval.

• Sensitive data requests require verification through an approved channel.

• Urgent executive requests should not automatically bypass normal processes.

The goal is to make verification part of the workflow rather than something employees are expected to remember under pressure.

3. Strengthen Hiring and Onboarding

Identity verification should continue beyond the interview stage.

• Strong identity verification

• Independent reference checks

• Verified contact information

• Additional checks for remote hires

• Controlled access during initial onboarding

• Monitoring unusual behaviour after account creation.

The principle is straightforward:

Trust should increase as evidence increases.

4. Use Deepfake Detection as One Layer, Not Entire Defence

AI-assisted detection can be valuable, but it should sit alongside identity verification, access controls, behavioural analytics and transaction monitoring.

No single tool can reliably solve a problem that combines technology, psychology and social engineering.

5. Make It Safe to Pause

Attackers rely heavily on urgency.

“Do this immediately.”

“Don't tell anyone.”

“This is confidential.”

“We cannot follow the normal process.”

These phrases should make employees more cautious, not less.

Organisations should create a culture where employees can pause an unusual request without worrying that they are being difficult or insubordinate.

Sometimes, the most effective security control is permission to ask one more question.

6. Monitor the Full Identity Lifecycle

Identity risk does not end after authentication.

Organisations should look at the complete lifecycle:

Recruitment → Onboarding → Authentication → Access → Behavior → Transactions → Offboarding

This broader view helps security teams identify inconsistencies that may otherwise remain invisible.

The threat is no longer hypothetical. Recent research shows just how quickly synthetic identity attacks are becoming an organisational security concern:

• A 2,665% increase in native virtual camera attacks was reported by iProov in 2024, alongside a 300% increase in face-swap attacks. [Source: iProov, 2025]

• $17.4 million was the average annualised cost of insider-risk incidents reported in Ponemon's 2025 research. [Source: Ponemon Institute, 2025].

The numbers vary by methodology, sector and attack type. But the direction is consistent.

These figures point to a broader shift: Synthetic identity and impersonation are becoming operational security risks, not just emerging technology concerns.

For years, cybersecurity teams have focused on controlling what people inside an organisation could access and what they could do.

Deepfakes introduce a different problem.

Now organisations also have to question who they are actually interacting with.

An attacker may not need to steal an executive's password. They may not need to compromise the executive's laptop. They may not even need to enter the network.

They may simply need to convince someone else that they are the executive.

That changes the nature of insider risk.

Deepfake protection therefore cannot sit entirely with the security team. Finance, HR, IT, legal, procurement and business leadership all have a role to play.

The answer is not to distrust every video call or assume every voice is fake.

Instead, stop treating familiarity as proof.

Use Deepfake technology to detect suspicious signals. Use behavioural analytics to identify unusual activity. Use strong identity controls to protect access. And, most importantly, build processes that give people a reason and the authority to pause before acting on an unusual request.

Because when seeing is no longer believing, verification becomes the new trust.

At 63SATS Cybertech, we believe effective cyber defence starts with understanding how threats move across technology, people and processes. As organisations face increasingly sophisticated forms of identity deception, connecting threat intelligence with behavioural context and actionable security controls becomes increasingly important.

The face may be familiar. The voice may sound right. But security starts with knowing who and what is really on the other side.