Deepfakes and boardroom risk: what should identity teams do next?

TL;DR: 75% of security leaders say it will take a leader being personally fooled or impersonated before deepfakes become a boardroom priority, according to Pindrop, showing how many organisations still treat the threat as reputational rather than operational. That assumption is no longer defensible: live communication channels now need identity controls, not just awareness.

Editorial analysis by NHI Mgmt Group, based on content published by Pindrop: “Deepfakes won't become a boardroom priority until it hits an executive”.

By the numbers:

• 75% of security leaders agree it will take a leader at their organization being personally fooled or impersonated before deepfakes become a genuine boardroom priority.
• 37% think a deepfake attack could end a company.

Key questions

Q: What breaks when organisations rely on voice or video to verify executives?

A: Voice and video verification break when the organisation treats them as proof rather than as one signal among many.

Q: Why do deepfakes create a governance problem for security teams?

A: Deepfakes create a governance problem because they undermine trust in evidence used for decisions, approvals, fraud checks, and incident response.

Q: How should security teams defend against deepfake fraud in executive approval workflows?

A: They should require out-of-band verification, role separation, and documented approval steps for any high-risk request.

Practitioner guidance

• Map high-risk live channels Identify which approvals, disclosures, and resets still depend on voice, video, or messaging without a second verification factor.
• Add step-up verification for sensitive requests Require out-of-band confirmation for payment changes, privileged access requests, executive instructions, and urgent support escalations.
• Train executives and finance teams on impersonation cues Focus training on request validation habits, not just on spotting fake media, and rehearse refusal to act on unverified urgency.

Bottom line: Deepfakes should be treated as identity attacks because they can hijack trusted live channels and drive real business decisions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →