Topic starter
10/07/2026 9:17 pm
TL;DR: Deepfakes can now be produced for less than $10 a month, and Incode argues that visual inspection is no longer enough because the problem has shifted from media trust to identity verification and access control in high-stakes government workflows. Liveness and session-context signals now matter more than spotting artifacts.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: ““Pretty Sure” Isn’t Good Enough. Why Deepfake Detection Must Go Deeper”.
Key questions
Q: What breaks when organisations rely on visual review for remote identity proofing?
A: Visual review breaks because deepfakes can now look convincing enough to pass a fast human check, while the real decision is whether a live person is present on a trustworthy device.
Q: Why do deepfakes create access-control risk instead of just misinformation risk?
A: They create access-control risk because the attacker is no longer trying only to persuade an audience.
Q: How can security teams tell whether identity verification is failing against AI-generated media?
A: The signs usually appear as mismatched capture behaviour, repeated challenge failures, unusual device or session patterns, and verified users whose actions do not fit prior context.
Practitioner guidance
- Prioritise high-risk verification workflows Map the identity journeys where a false accept would cause the most damage, such as privileged access, benefits issuance, contractor onboarding, and resident account creation.
- Replace manual image review with liveness-based assurance Use active liveness and presentation-attack resistance for remote proofing so the control evaluates live interaction, not just facial appearance.
- Add device and session integrity checks Correlate verification with camera integrity, replay detection, and device state so a hijacked endpoint cannot present synthetic media as a live user.
Bottom line: Deepfake detection is now part of identity assurance because synthetic media can satisfy weak verification gates even when humans suspect manipulation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Deepfake detection has become an identity assurance problem, not a media authenticity problem. The source article is right to frame synthetic media as a control issue in access and onboarding decisions. Once the output of an identity flow can be generated cheaply, the verification layer has to prove presence and context, not just detect visual anomalies. That changes the governance question from 'can we spot the fake?' to 'can this control establish trust at the moment access is granted?'
A few things that frame the scale:
- According to a recent Gartner report, 40% of government organizations are expected to establish dedicated trust operations functions by 2028 to combat deepfakes.
A question worth separating out:
Q: What should agencies do when deepfake attacks target onboarding and benefits workflows?
A: They should raise assurance first at the highest-risk moments in the journey, then require controls that validate the live interaction rather than the media alone. That means connecting proofing strength to the sensitivity of the entitlement being issued, so the verification burden matches the impact of a false accept.
👉 Read our full editorial: Deepfake detection now functions as identity verification control