A couple of years ago, when people talked about deepfakes, it was mostly about viral videos or political misinformation; today, what we are seeing is a question of whether you can tell if the person on the other end of a call is real. Deepfake technology has evolved drastically, especially as AI continues to advance and we are introduced to generative AI. In a 2025 Gartner survey, 62% of organizations experienced a deepfake attack involving social engineering or exploiting automated processes.

This blog features insights from Halil Ibrahim Dursunoglu, Faculty Specialist, Computer Science and Cybersecurity at Western Michigan University. We will explore how Generative AI has fundamentally transformed the enterprise threat landscape, examine the emergence of new attack vectors, and discuss why organizations must adopt a synchronized intelligence mindset to combat these sophisticated attacks.

How Generative AI fundamentally transformed the enterprise threat landscape

Dursunoglu mentioned one major shift which is modern generative models increasingly eliminate the visual artifacts that older detection systems relied on. Diffusion and transformer-based systems can produce temporally coherent video and highly realistic biometric content that bypasses traditional frame-level inspection methods. Synthetic identity fraud is also becoming more sophisticated. Attackers can combine stolen personal information with AI-generated faces, fabricated documents, and cloned biometric traits to create entirely synthetic personas capable of bypassing remote onboarding and identity verification systems.

This creates significant risk for many organizations such as financial institutions, healthcare organizations, and enterprises relying heavily on digital trust and remote authentication workflows. Perhaps the most important transformation is that generative AI attacks target human trust directly rather than exploiting only technical vulnerabilities. As a result, digital trust itself has become an attack surface.

Dursunoglu emphasized that “Organizations must now defend not only infrastructure and credentials, but also the authenticity of communications, identities, and interactions across enterprise environments.”

Generative AI has fundamentally redefined the scale and sophistication of deepfake-driven fraud and synthetic identity fraud.

The primary new attack vectors emerging from this evolution

Dursunoglu highlighted three new attack vectors that emerged from generative AI:

AI-driven executive impersonation

Attackers are increasingly using voice cloning and synthetic media to imitate senior leadership during financial approval workflows, vendor communications, and internal authorization processes. In several publicly reported incidents, organizations were deceived into transferring large sums of money after employees received convincing AI-generated voice messages that appeared to come from trusted executives.

A widely cited example occurred in 2-019 when criminals used AI-based voice cloning technology to impersonate the CEO of a UK-based energy firm’s parent company. According to public reports, the attackers generated a convincing synthetic version of the executive’s voice and instructed an employee to urgently transfer approximately €220,000 to a supplier account controlled by the attackers. The employee believed the request was legitimate because the cloned voice closely matched the executive’s tone, accent, and speaking style.

Synthetic identity fraud

Attackers can combine stolen personal information with AI-generated faces, fabricated identity documents, and cloned biometric traits to create entirely synthetic personas. These identities can be used to bypass remote onboarding systems, open fraudulent accounts, access financial services, or infiltrate digital platforms that rely heavily on automated identity verification.

Synthetic phishing

Traditional phishing attempts can now be reinforced with cloned voice calls, deepfake video messages, or AI-generated meeting invitations that significantly increase credibility and psychological pressure. This makes social engineering attacks more convincing and more difficult for employees to identify. A growing operational concern is real-time impersonation during video conferencing and customer support interactions.

As generative models improve and latency decreases, attackers may increasingly manipulate live audio and video streams to bypass remote verification processes, impersonate trusted personnel, or gain unauthorized access to sensitive systems. These attacks are particularly dangerous because they exploit trusted relationships and business workflows directly. Unlike traditional malware campaigns that target infrastructure vulnerabilities, synthetic media attacks focus on manipulating human decision-making and identity assurance mechanisms, making them highly effective even in organizations with mature technical security controls.

Challenges organizations face

Dursunoglu described three major challenges organizations face

1. Synthetic media capabilities are evolving faster than enterprise security controls.

Many current defenses were designed to detect older generations of deepfakes that contained visible artifacts such as pixel inconsistencies, facial distortions, compression anomalies, or irregular blinking patterns. Modern diffusion and transformer-based generative models are increasingly eliminating these detectable traces, making visual-only detection methods far less reliable.

2. Scaling

Generative AI enables attackers to automate impersonation and social engineering campaigns at a level that was previously impractical. Security teams are no longer dealing with isolated fake videos or phishing emails, but with scalable AI-driven impersonation capable of targeting employees, executives, customers, and remote verification systems simultaneously.

3. Operational gaps

Many enterprise workflows still assume that realistic audio or video content can be trusted if it appears visually coherent. Remote onboarding systems, customer verification processes, and executive communication channels were not originally designed to validate synthetic media threats in real time.

The shift to synchronization intelligence

Traditional visual-only controls are no longer sufficient because they focus primarily on surface appearance rather than behavioral authenticity. Which is why organizations need to adopt a synchronization intelligence process as it addresses these flaws by shifting detection away from surface-level visual artifacts and toward behavioral consistency across audio and visual signals as Dursunoglu stated. Instead of asking whether a video frame appears synthetic, synchronization-based approaches evaluate whether speech patterns, lip movements, facial dynamics, and timing relationships behave naturally together over time. Human speech and facial motion follow highly coordinated physical and linguistic patterns. Lip movements correspond to phoneme production with precise temporal relationships that are difficult for generative models to reproduce consistently, especially across extended sequences.

Dursunoglu highlighted that “synchronization intelligence uses cross-modal analysis to measure coherence between audio and facial motion across multiple temporal scales. Instead of relying on static signatures tied to a specific generation model, it analyzes dynamic relationships that are fundamentally harder to synthesize consistently in real-world conditions.”

As generative AI systems continue improving visually, defenders must increasingly evaluate whether digital interactions behave authentically, not simply whether they look realistic.

Synchronization scoring

Dursunoglu summarized synchronization scoring and it is most effective when integrated as a risk signal within existing enterprise workflows, strengthening decision-making by adding behavioral validation to environments exposed to synthetic media. In fraud prevention and digital onboarding, it supplements traditional liveness detection by identifying abnormal audio-visual alignment during high-risk transactions or identity verification. By analyzing whether facial motion and speech remain naturally aligned, organizations can trigger additional verification requirements or escalate suspicious interactions to human review in real-time.

In SOC environments, this intelligence functions as contextual data to enrich alerts related to impersonation or suspicious collaborations, improving investigation prioritization. The broader advantage is adaptability; because it focuses on behavioral consistency rather than static visual artifacts, it remains resilient as generative AI evolves. When combined with Zero Trust principles and risk-based authentication, synchronization scoring becomes a critical component of a layered defense strategy against advanced synthetic attacks.

Actionable steps can organizations take today

Dursunoglu highlighted four critical steps organizations can take today to combat generative AI-driven synthetic fraud and restore digital trust:

• Prioritize High-Risk Workflows: Identify and secure critical operations—such as financial approvals, executive communications, and remote identity verification—where AI-driven impersonation poses the greatest systemic risk.

• Adopt Layered Verification: Move beyond single-layer trust models by combining behavioral analytics, liveness detection, and risk-based authentication to replace traditional static checks that are easily bypassed by modern AI.

• Integrate Synthetic Threat Modeling: Incorporate deepfake-enabled impersonation and synthetic identity scenarios into existing security programs, including red-team assessments and incident response tabletop exercises.

• Evolve Awareness and Governance: Update employee training to address advanced social engineering while establishing clear governance for monitoring AI risks and maintaining human oversight for high-impact decisions.

Echoing what Dursunoglu said, “Most importantly, organizations must recognize that synthetic media threats are already operational, not theoretical. Protecting digital trust at scale requires treating generative AI as a long-term security and identity challenge that will continue evolving alongside enterprise technology ecosystems.” To learn more about how to combat against synthetic fraud and deepfakes, we invite you to visit our RSAC library.