If you’ve recently scrolled through your Facebook feed and been startled to see a famous movie scene, but with your friend’s face in place of the actor, you have an idea of what deepfake technology can do.
A deepfake is essentially a sophisticated forgery of an image, video or audio clip, done using artificial intelligence (AI). That Snapchat filter that makes you look like a kittycat is also a form of deepfake tech.
The problem is that not all applications of deepfake technology is as innocuous as inserting yourself in a movie scene or growing whiskers. Hackers are using AI and deepfakes to defraud businesses, ruin their reputations, or both.
Consider the longtime phishing scam of an email that appears to be from the CEO, asking an employee to wire money in order to pay an “invoice.” What if instead of an email, that was a video message of the CEO making the same request? Or asking an employee to let the “fire inspectors” into the building after hours? AI technology now makes that possible.
For larger organizations especially, the risk of reputational damage is high. Since a person can be made to appear to say anything at all in a video, hackers can spread false or damaging information. Imagine that same CEO badmouthing a competitor, or saying socially unacceptable things, in a video that’s then turned loose on social media. It looks and sounds real even though it’s not, and the reputational damage to the organization might never be fully undone.
What can your organization do to protect itself? Here are three suggestions:
Train employees: Your team can’t be on the lookout for something if they don’t know it exists. Make them aware that deepfake technology is a real threat, and make it clear that they will not receive any video or audio messages from you without being notified first.
Detection software: Microsoft, Facebook and other are using AI-base software to detect altered videos. You can do the same. There are many scanning tools available online, and the sooner you can detect a fake the better your chances of limiting the damage.
Prepare for the worst: Plan a response to a deepfake incident and add it to your cyber-response plan (if you don’t have one, now’s the time). This response will center on crisis mitigation. Make sure individual responsibilities are clearly defined and that everyone is up to date on best practices for responding to such an incident.
Questions about cyber liability threats or coverage? Contact Consolidated Insurance.