The more sustainable approach is to design business processes that remain secure even when impersonation succeeds.
A payment instruction, change in supplier banking details or request to reset privileged credentials should require independent verification through an established, trusted channel. This means calling an executive using a previously verified telephone number rather than responding through the channel used to initiate the suspicious request.
Sanchez also believes employees should examine the business context of unusual instructions.
A confidential transaction outside established procedures, an unfamiliar communication channel or a request inconsistent with normal operations should trigger additional scrutiny.
Such controls are particularly important when attackers exploit urgency and seniority to pressure employees into bypassing approval processes.
Haber summarises the principle succinctly.“ Trust the process, not the threat actor’ s performance to duplicate the attributes of an identity.”
For security leaders, this requires collaboration beyond the cybersecurity department. Finance, human resources, legal, procurement and executive leadership must understand and consistently enforce verification procedures.
Fighting AI with AI
Artificial Intelligence also has an important defensive role.
Deepfake detection systems can examine audio irregularities, facial movements, video artefacts and metadata for signs of manipulation.
Behavioural analytics can identify suspicious authentication patterns, unfamiliar devices, unusual account-recovery attempts and transactions that deviate from established activity.
For example, a payment request involving a new beneficiary, an unexpected amount or an unusual approval sequence may warrant intervention regardless of whether the accompanying video appears authentic.
However, defensive AI is not infallible.
Detection accuracy depends on model quality, available telemetry and the sophistication of the attack. False positives and false negatives remain unavoidable.
Haber cautions against assuming that defensive AI will consistently outperform attackers using similar technologies.
“ The strongest defence is not an AI model that claims to detect every deepfake, but an identity security architecture that limits the consequences when detection fails and the blast radius can be limited.”
Narayanan similarly advocates integrating security intelligence across email, endpoints, networks, cloud environments and identity systems.
The objective is to correlate multiple indicators and prevent unauthorised activity even when an individual detection mechanism fails.
For CISOs, the distinction is important. Identifying synthetic content is useful, but preventing fraudulent actions is ultimately what protects the organisation.
Building a culture of verification
Deepfake resilience is not exclusively a technology challenge. It also requires organisations to rethink employee awareness, incident response and the culture surrounding executive authority.
Traditional cybersecurity training frequently teaches employees to identify suspicious links, spelling errors and unusual email addresses.
AI-generated communications can eliminate many of these warning signs.
Employees therefore need practical guidance on verifying sensitive requests rather than relying on their ability to recognise manipulated content.
Organisations need procedures for suspending transactions, revoking access, preserving evidence and coordinating with financial institutions and relevant authorities.
The ability to recognise a voice, identify a face or authenticate an account is no longer sufficient on its own. Trust must be continuously evaluated against context, permissions and the legitimacy of the action being requested.
For Middle East CISOs, the priority is not to create an organisation in which nobody can ever be deceived. It is to ensure that deception does not automatically result in compromise.
40 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST