How should organisations verify that media has not been altered before they use it?

How to verify media has not been altered

Verification starts by checking whether the media can be authenticated against a trusted origin, not just whether it “looks real.” Cryptographic signatures, signed manifests and preserved capture metadata let you test integrity after export, copying or platform reprocessing. If the media cannot be tied back to a known capture or approval path, treat it as unverified until proven otherwise.

That matters because alteration is often subtle: a crop, recompression, overlay, frame insertion or metadata rewrite may not be obvious to the eye. Organisations need a process that checks provenance and integrity together, because either one alone can fail.

What good verification evidence should include

Strong verification evidence usually combines technical and operational signals. A signed file or signed metadata record proves more than a checksum alone because it can show both integrity and source context. Trusted capture controls, such as controlled devices, time-stamped acquisition and protected chain-of-custody records, make it easier to confirm that the media was created where and when it claims to have been created.

For higher-risk use cases, the verification result should be easy to repeat and easy to audit. That means the verifier should be able to see which source system produced the file, which key or trust anchor was used, whether the metadata was preserved, and whether any transformation happened after capture. When media passes through editing, transcoding or platform distribution, those steps should be visible rather than hidden.

When media should not be trusted yet

Media should remain untrusted whenever the chain from capture to review is incomplete, the signature is missing or broken, or the metadata no longer matches the expected source path. The safest rule is to require verification before media is used in approvals, customer communications, disciplinary action, public statements or any other decision where a manipulated file could cause harm.

Teams should also be cautious when a file is exported from a system that strips provenance data, because the absence of metadata can be as important as its presence. If the media arrived through messaging apps, shared drives or user-upload paths without preservation controls, the burden of proof shifts to the organisation that wants to rely on it.

Risk and Threat Considerations

Altered media can be used to mislead decision-makers, create fraudulent evidence or damage trust in public-facing content. The main risk is not only deception, but also the false confidence that comes from treating a convenient file as if it were verified.

Failure mechanism: Attackers or insiders can edit, re-encode, repackage or relabel content so that the visible file appears normal while its provenance and integrity are no longer trustworthy. Metadata can also be removed or rewritten during export, which makes weak verification controls accept manipulated content as authentic.

Impact: Organisations may approve false evidence, publish inaccurate claims, mis-handle complaints or investigations, and lose confidence in legitimate media that cannot be independently verified later.

Practitioner Guidance

What to verify first: Check whether the media has a verifiable source, an intact signature or hash, and a preserved metadata trail that matches the expected capture process. If any one of those is missing, treat the file as evidence that needs validation, not as a trusted input.

Decision rule: If the media can influence a customer decision, legal action, public claim or security outcome, require verification before use. If it is only for low-stakes internal reference, a lighter control may be acceptable, but the file should still be traceable back to origin.

Practitioner takeaway: The control objective is not to prove that a file is visually convincing, but to make its origin and integrity independently checkable after it leaves the original system.

Related resources from NHI Mgmt Group

• How should organisations verify whether media is authentic before they act on it?
• Should organisations use automation before they mature their entitlement model?
• Should organisations use AI for identity governance before they clean up data and policies?
• Should organisations use agentic AppSec tools before they have full secrets governance?