What Executives and Boards Need to Know About Deepfake Risk

What do executives and boards need to know about deepfake risk?

Executives and boards need to know three things about deepfake risk. First, the losses come through ordinary business processes: a payment approved after a call, a password reset granted to a cloned voice, an account opened with a swapped face. Second, staff cannot be trained to spot good fakes reliably, so the defence has to be built into the process. Third, detection tools help, but they produce a signal that policy acts on rather than a verdict.

The risk is also reputational. A fabricated video of a chief executive announcing a recall, a layoff or a market-moving statement can spread before communications teams react. Boards should expect management to have a plan for both cases: fraud against the company and false media about the company.

Why should CISOs care about deepfake threats?

CISOs should care because deepfakes attack identity, which is now the centre of most security programmes. A cloned voice defeats a help desk that recognises callers, a face swap defeats a selfie check without injection controls, and a fake executive on a video call defeats a finance team that trusts what it sees. None of these needs malware, so endpoint and network tools see nothing.

The evidence is concrete. Hong Kong police said a finance employee at Arup made 15 transfers totalling HK$200m after a call in which the other participants were fake, and Arup confirmed the case in May 2024. Deloitte's Center for Financial Services projects that generative AI could raise US fraud losses from $12.3 billion in 2023 to $40 billion by 2027, a compound annual growth rate of 32%. The US Financial Crimes Enforcement Network issued alert FIN-2024-Alert004 on 13 November 2024 describing deepfake schemes against financial institutions.

Which business workflows carry the highest deepfake risk?

The highest-risk workflows are the ones where a voice, a face or a document can trigger money movement, access or disclosure without an independent check. Ranking them by consequence, rather than by how convincing a fake might be, gives management a clear list of where to put controls first.

Most organizations find the same handful at the top: treasury and high-value payments, vendor bank changes, help desk password and MFA resets, remote customer onboarding and account recovery, and executive communications to investors and the public. Each needs a control that would still work if the voice or face were perfect.

Why deepfake detection starts at the top, and who should own it

Deepfake detection starts at the top because the controls that matter cut across departments, and only senior leadership can make finance, the help desk, product and communications change their processes together. Without a mandate, each team assumes another one is handling it.

One named executive should own the programme. In most companies that is the CISO, because deepfake attacks are identity attacks and the incident response machinery already sits in security. Workflow owners stay accountable for their own controls, legal advises on disclosure and evidence, and the audit or risk committee oversees progress. The board's role is to ask for the risk register entry, the owner, the controls on each high-risk workflow and the test results.

Leaders also set the culture. A rule that any employee may delay a request from the chief executive until it is verified only works if the chief executive says so publicly and means it.

What should CISOs require from deepfake detection?

CISOs should require detection that covers the media types their high-risk workflows actually use, returns evidence rather than a bare score, publishes benchmark results with a method others can check, and deploys in a way that satisfies data protection rules. Latency matters where detection sits in a live flow such as onboarding; it matters less for forensic review.

Neural Defend's figures map to those requirements. NeuroVerify checks a face image, video or audio in one API call and returns a unified risk score with signal-level evidence from six signals; Neural Defend states under 200 ms p95 for eligible image requests under defined test conditions. NeuroDetect is a forensic workspace that keeps model and version context and produces downloadable reports. Deployment options are managed cloud, private cloud or VPC, secure container, on-premises and air-gapped, and the company holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II.

On the public VendorBench-100 benchmark of 100 difficult still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next-best vendor, Reality Defender. One VendorBench author also co-authored Neural Defend's ARCAS 1B paper, so the benchmark is not independent; its corpus and results are public, and buyers should rerun it or test on their own data. It measures still images only, not video, audio or injection attacks.

• Coverage of the image, video, audio or document types used in your high-risk workflows.
• Evidence with each result, such as region, frame or segment views, and stated uncertainty.
• Published benchmark results on public data, with the conflicts of interest disclosed.
• Deployment and data handling that meet residency and retention requirements.
• A proof of concept on your own media before any contract.

Disclosure duties and regulation boards should track

In the United States, the SEC's cybersecurity rules adopted on 26 July 2023 require listed companies to describe the board's oversight of cybersecurity risk and generally to file a Form 8-K within four business days of determining that an incident is material. A large deepfake-enabled fraud can meet that bar, so the disclosure committee should know how such incidents are escalated.

For banks, FinCEN's alert FIN-2024-Alert004 lists red flags such as a customer's photo flagged by deepfake detection software or the use of a third-party webcam plugin during live verification, and asks institutions to use the keyword FIN-2024-DEEPFAKEFRAUD in suspicious activity reports. In the EU, Article 50 of the AI Act, which applies from 2 August 2026, requires deployers of AI systems that generate deep fakes to disclose that the content is artificially generated or manipulated.

Questions boards should ask management

Board oversight works best through a short set of recurring questions with evidence behind the answers. Ask them once a year at least, and after any significant incident in the sector.

• Who owns deepfake risk, and where does it appear in the risk register?
• Which workflows can move money, grant access or disclose data on a voice, face or document alone?
• What happened in the last exercise in which a fake executive called finance or the help desk?
• How would we deny a fabricated video of our chief executive within an hour?
• What detection is in place, what did it flag last quarter, and how were the results tested?