"The biggest change is the collapse in the cost, time and technical expertise required to create a convincing deepfake," Simic explains.

According to HYPR's 2026 State of Passwordless Identity Assurance report, 87% of surveyed organizations reported encountering audio or video deepfakes in identity-based attacks.

The implications extend far beyond recruiting. Executive impersonation, fraudulent credential resets, compromised help desks and unauthorized financial transactions all exploit the same vulnerability: Organizations routinely trust what appears familiar.

"Voice and video are communication interfaces. They are not authentication factors," Simic says.

Why deepfake detection alone isn't enough to prevent attacks

For years, cybersecurity awareness training has emphasized recognizing suspicious emails, unusual requests and other warning signs. But generative AI increasingly enables attackers to reproduce familiar voices, faces and conversational patterns.

Simic argues that organizations must stop expecting employees to distinguish authentic communications from sophisticated synthetic content.

Instead, sensitive actions — including wire transfers, payroll changes, credential recovery and privileged access — should require independent identity verification through secure, established authentication processes.

That includes phishing-resistant authentication, device-bound credentials and stronger controls around account recovery. Critically, organizations must prevent employees or administrators from bypassing those protections simply because a caller appears credible or claims executive authority.

Deepfake detection technology can provide useful signals, Simic acknowledges, but it should not become the foundation of enterprise security.

"Build the process under the assumption that eventually the fake will be good enough to fool both the person and the detection technology," he advises.

The objective is not to recognize every deception. It is to ensure that deception alone cannot authorize a consequential action.

How can enterprises verify AI-generated content and establish trust?

Leong sees an additional complication: As AI-generated content becomes commonplace, distinguishing synthetic material from human-created content may become less useful than determining whether information is accurate, reliable and authorized.

Not all AI-generated communications are malicious. Organizations increasingly use AI to develop marketing materials, support customers and produce business content. The challenge is establishing appropriate safeguards without treating every AI-assisted communication as inherently untrustworthy.

Leong points to emerging transparency requirements, content labeling and machine-readable disclosures as components of a broader approach. However, the absence of an AI label does not establish that content is authentic. Her perspective shifts the discussion from detection alone toward accountability.

Organizations must establish policies governing acceptable AI use, disclosure, verification and responsibility when synthetic content causes harm.

That requires a broader enterprise response than cybersecurity teams can deliver independently.

Building AI governance to manage deepfake and misinformation risks

For Leong, effective preparation begins with existing AI governance and risk-management frameworks. Organizations should identify potential harms, assess their likelihood and consequences and establish appropriate technical, legal, contractual and operational safeguards.

Importantly, responsibility depends on the specific technology and circumstances.

A synthetic voice used to obtain system access may demand a security-led response. A fabricated executive video circulating publicly could involve communications, legal, compliance and executive leadership. Misleading AI-generated advertising may introduce additional regulatory and reputational concerns.

"Not all AI incidents are security related," Leong emphasizes.

Frameworks such as the NIST AI Risk Management Framework and ISO 42001 can help organizations establish oversight responsibilities and coordinate stakeholders.

Rather than assigning every AI-related incident to IT, enterprises need clearly defined roles, escalation procedures and decision-making authority across functions.

The goal is to establish these relationships before an incident forces teams to coordinate under pressure.

How to prepare for and respond to AI-generated deception

Even strong preventive controls cannot eliminate every risk.

Leong recommends developing AI-specific incident-response plans that follow familiar crisis-management stages: preparation, identification, containment, eradication, recovery and lessons learned.

However, AI incidents introduce complications that traditional cybersecurity playbooks may not fully address. Harmful synthetic content can spread beyond corporate systems, raise multiple legal considerations and prove difficult, or even impossible, to remove completely.

Consider a fabricated recording of a CEO circulating among employees or customers. Who receives the initial report? Who determines whether the recording is authentic? When should the organization issue a correction? And how can leadership respond without unintentionally amplifying the misinformation?

These questions should be answered through preparation, not improvisation.

Leong advocates tabletop exercises and red-team scenarios that reflect an organization's actual exposure, including operational disruption, reputational damage and misuse of its own AI systems.

She also stresses employee awareness of established reporting channels so suspicious content can reach the appropriate response team quickly.

Organizations that have already developed strong cross-functional governance structures will be better positioned to coordinate an effective response.

The future of enterprise identity verification and digital trust

The information battlefield will only become more complicated as synthetic media improves, and autonomous AI agents gain greater access to enterprise systems.

Simic anticipates a future in which identity assurance must extend beyond initial login to sensitive actions throughout the user life cycle. Leong similarly warns that organizations cannot assume a system or process remains safe simply because it has previously been tested.

Both perspectives point toward a fundamental change in enterprise preparedness.

Organizations must continuously evaluate emerging risks, strengthen authentication, coordinate governance and rehearse their responses to synthetic-content incidents.

The ultimate objective is not to eliminate every deepfake or identify every piece of AI-generated misinformation, but to create an operating environment where trust rests on independently established evidence, accountable processes and resilient controls.

As Simic puts it, enterprises must move "from trusting what appears to be true to verifying what can actually be proven."