Liar’s dividend

Expanded Definition

The liar's dividend describes a credibility gap created by generative AI and deepfake tooling: once audiences know synthetic media is possible, authentic evidence can be dismissed with less scrutiny. That makes the term especially relevant in cybersecurity, investigations, and executive risk management, where proof often depends on audio, video, screenshots, or documents. It is not the same as a deepfake itself. A deepfake is fabricated content; the liar's dividend is the defensive advantage gained by denying that genuine content is real. This distinction matters because the risk is social and procedural as much as technical. Standards such as NIST SP 800-53 Rev 5 Security and Privacy Controls help organisations frame evidence handling, integrity, auditability, and incident response, but no single standard fully resolves the trust problem created by synthetic media. Usage in the industry is still evolving, and definitions vary across vendors when the term is folded into broader misinformation or AI fraud narratives. The most common misapplication is treating every contested recording as potentially fake, which occurs when teams lack provenance controls and default to blanket skepticism instead of evidence-based verification.

Examples and Use Cases

Implementing liar's dividend defences rigorously often introduces verification friction, requiring organisations to weigh faster decision-making against stronger evidentiary assurance.

• A finance team receives a voice note apparently from a chief executive authorising an urgent transfer, and the real executive later claims the note is synthetic even before forensic review is complete.
• A journalist publishes a genuine video of a public official, but the official dismisses it as AI-generated, shifting the burden from the content to the proof process.
• A security operations centre reviews a screen recording of credential theft activity, yet the attacker argues the clip was fabricated, forcing the team to rely on logs, timestamps, and chain of custody.
• An HR investigation uses an audio clip in a misconduct case, and both parties dispute authenticity because deepfake concerns have lowered trust in all recorded evidence.
• A public sector communication team issues a correction after a fake clip circulates, but the liar's dividend persists because authentic follow-up footage is also treated with suspicion.

For defenders, the lesson is to preserve provenance early, not after a dispute begins. NIST guidance on control families and system integrity helps organisations document evidence handling, but the practical issue is often whether a file can be authenticated quickly enough to remain useful.

Why It Matters for Security Teams

The liar's dividend changes the attacker-defender balance by letting false denials do damage even when the original evidence is real. Security teams need to understand it because incident response, fraud handling, insider threat investigations, and executive verification now depend on more than the content itself. They depend on metadata, capture context, custody records, and corroborating signals from adjacent systems. In identity-heavy environments, this intersects with NHI and agentic AI governance as well: synthetic audio or video can be used to challenge approvals, impersonate decision makers, or undermine trust in automated workflows that rely on human sign-off. The risk is not limited to deception at creation time; it extends to the moment evidence must be trusted under pressure. Controls for logging, timestamping, immutable storage, and authentication of sources become part of resilience, not just compliance. Organisations typically encounter the operational cost of the liar's dividend only after a real incident is publicly disputed, at which point evidence validation becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Reuse Dividend