Getty Images
Beyond Arup: CISOs combat escalating deepfake fraud
In the two years since the landmark Arup attack, deepfake technology has rapidly matured. Cybersecurity and legal experts analyze why traditional controls fail against live executive clones.
As generative AI video and audio cloning tools reach near-flawless fidelity, deepfake-driven corporate fraud has evolved from an isolated high-profile anomaly into a systemic enterprise risk. Following a surge in video conference impersonation and synthetic executive social engineering over the past year, security leaders are being forced to rethink the fundamentals of identity and trust.
The turning point came in early 2024, when an employee at the engineering firm Arup was duped by AI deepfakes posing as the company's CFO and colleagues during a live video call, authorizing $25.6 million in fraudulent transfers.
While Arup stood as a rare, ultra-sophisticated attack at the time, two years of generative AI development have dramatically lowered the barrier to entry, turning live synthetic impersonation into a repeatable threat vector.
Threat actors are growing more confident using deepfakes. A survey from Regula found that the share of surveyed businesses reporting video deepfake fraud jumped from 29% in 2022 to 49% in 2024. Audio deepfake fraud rose from 37% to 49% over the same period. Gartner reported in September 2025 that 62% of organizations had experienced a deepfake attack involving social engineering or exploitation of automated processes within the previous 12 months.
The real-world consequences of that surge were laid bare in September 2026, when Reuters reported that fraudsters used AI voice cloning and impersonation to trick executives at Fideuram -- the private banking arm of Italian financial giant Intesa Sanpaolo -- into authorizing transfers totaling €95 million ($108 million). The incident dwarfed previous benchmarks, proving that live executive impersonation has rapidly evolved into one of the highest-value threat vectors facing enterprise finance.
As deepfakes of the C-suite become more common in enterprises, cybersecurity and data privacy experts told TechTarget what security professionals need to know and explained how CISOs can mitigate the threat.
Weaponizing executive visibility
Ofer Familier, CEO and co-founder of the social intelligence firm Dig, noted that, in addition to the direct security risks, deepfakes can erode trust in an organization.
"For most of our lives, seeing someone’s face or hearing their voice gave us a very high degree of confidence that we were actually dealing with that person," he said. "Deepfakes fundamentally change that assumption. A video call from an executive, a voice message from a CFO, or an urgent request from a colleague can now be fabricated convincingly enough to make someone act. That creates very practical risks around payments, credentials, access and sensitive information."
Familier added that the secondary damage often shows up in workflow efficiency. "Once an organization experiences something like this, people naturally become more cautious," he said. "Requests that used to take 10 seconds to approve now require another verification step. That caution is necessary, but it creates friction across the organization and that friction has a real operational cost."
While digital privacy laws continue to evolve, legal safeguards offer little protection against borderless cybercriminals. With generative tools widely accessible and executive media permanently available online, preventing deepfakes at the point of creation is virtually impossible, shifting the burden entirely onto enterprise defense.
"Companies cannot prevent someone from creating a deepfake, but they can prevent employees from acting on one," said Sherli Furst, an IP partner at Ellenoff Grossman & Schole and advisor on emerging issues involving AI-generated likenesses and digital replicas.
How CISOs can contain the deepfake blast radius
Because preventing deepfakes outright is impossible, containing the threat requires shifting focus from perimeter defense to operational resilience. Familier maintained that the unique nature of deepfake attacks requires specific hands-on scenario training that addresses both technical mechanics and digital communication trust.
"Telling employees to 'be vigilant' is not particularly useful," he advised. "Walking someone through a realistic scenario in which the CFO appears on a video call and asks for an urgent payment is much more effective, because people can recognize the situation when it happens."
Beyond training, organizations must establish strict out-of-band verification protocols that apply to everyone -- including executives making legitimate financial requests. Any transaction involving money, credentials, access or sensitive data must require mechanisms beyond a single voice or video interaction.
Zachery Myers, law partner at McCarter & English and former U.S. Attorney for the Southern District of Indiana, counseled that using "trusted communications channels to confirm any transactions or account accesses, employing multi-factor authentication and requiring multiple people to approve certain activities can go a long way to protecting against these threats."
Defensive strategies must also extend outside internal workflows to monitor external digital channels, where executive likenesses are routinely harvested or impersonated. While catching every attempt isn't feasible, proactive monitoring reduces the lifespan of rogue assets on public platforms.
"Detection technology is part of the answer, but I would be careful about making it the foundation of the strategy," stated Familier. "Generative technology is advancing extremely quickly, and there will always be a race between generation and detection."
Crucially, when an incident occurs, the fallout extends far beyond the SOC. Furst explained that, from a legal perspective, deepfakes raise issues involving fraud, rights of publicity, trademark, unfair competition, copyright and defamation.
"The response therefore needs to address both the immediate security threat and the longer-term legal and reputational harm," she said. "Security, legal and communications teams should respond together to stop transactions, secure accounts, preserve evidence, notify affected parties and remove fraudulent content where possible."
Redefining identity in the age of synthetic media
As platforms to generate AI likenesses grow more sophisticated and convincing, the C-suite's public content has become attack infrastructure. Speeches, podcasts, interviews, LinkedIn videos and earnings calls can all provide the raw material for deepfake attacks. An attacker doesn't even need to hack the company; they can borrow the credibility the company has spent years building.
"Deepfakes weaponize trust," said Furst. "Employees are trained to question suspicious emails, but it is much harder to question what appears to be your CEO or CFO speaking directly to you on a video call."
Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston's professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.
