A staff member receives a video call from a senior manager. Nothing seems unusual; both face and voice match. During the call, the manager makes one urgent request: approve the transfer before the end of the day.
The threat of deepfakes isn’t the accurate cloning of an individual’s physical appearance, it is that synthetic media can create enough urgency and authority to influence a human decision.
Rapid AI adoption across the UAE is reshaping human risk. Traditional employee training focused on suspicious links or poorly written emails is no longer sufficient. Employees may now encounter convincing voice notes, video calls, documents and digital identities created to impersonate trusted individuals.
The attack targets human decisions
Deepfake scams are often discussed as a detection issue: can an individual recognize odd facial patterns, eye movements, and a robotic-sounding voice?
A well-prepared attacker does not need to create a flawless imitation. All they require is to understand the organisation well enough to make the request believable.
LinkedIn pages can reveal the identity, job titles, and new hires, while a compromised email account can provide the context needed to execute the attack.
The strongest defence is not expecting employees to become deepfake experts. It is about ensuring that sensitive actions cannot be approved because one call, message or video appears convincing.
Speed creates a verification gap
The UAE’s international business environment creates a particular challenge. Teams are often working across different offices and time zones, leaders travel often, and important decisions are commonly communicated through video calls.
Attackers can exploit that normality. The message may appear to come from a CEO travelling abroad, a supplier asking for updated bank details, or a colleague requesting confidential information. In each case, the goal is to create a moment where urgency seems to be more important than verification.
Organisations should introduce a framework around high-risk decisions. Changes to payment details, unusual transfers, password resets and disclosure of sensitive data should require confirmation through a second trusted channel. Critical transactions should involve more than one approver, regardless of who appears to make the request.
The point is to slow down the few decisions where one mistake can cause serious financial, operational or reputational damage.
Senior leaders must also model the process. If employees are encouraged to verify requests but executives regularly demand exceptions, the control will fail when it matters most.
A genuine leader should expect a second approval or a short delay when the request may carry unusual risk.
Awareness must reflect how people actually work
Traditional cybersecurity awareness often relies on generic examples delivered annually. That is no longer enough for AI-enabled deception.
Training should reflect the situations employees may encounter in their own roles. Finance teams need to practise responding to executive impersonation and payment diversion. Human resources teams should be prepared for synthetic candidates, altered documents and requests involving employee data. Executive assistants and communications teams need structured procedures for verifying suspicious instructions and responding to unverified content involving senior leaders.
A simple way for employees to respond under urgency is by remembering the 3-step process:
- Pause: Take a step back and question the source of urgency.
- Verify: Verify the sources through a trusted channel, such as a verified phone number.
- Escalate: Report the request to the appropriate team before taking action.
A strong security culture does not punish hesitation. It gives people permission to challenge their senses.
Human risk is an operational issue
Deepfake resilience shouldn’t be seen as only a cybersecurity or an IT issue. It requires coordination between all the departments and their senior leadership.
Organisations should identify the people most likely to be impersonated, map the business processes an attacker could exploit, and define what happens when suspicious content appears. They should also prepare for the reputational side of a deepfake incident, including how official communications will be verified along with responding procedures, if fabricated content begins circulating online.
The UAE Cybersecurity Council has emphasised awareness and verification as essential defences against AI-enabled fraud, warning that AI can create realistic voice imitations, altered branding and convincing urgent requests.
Recent research has also found that AI adoption across UAE organisations is moving faster than the controls designed to manage the risks. Proofpoint’s 2026 UAE findings reported that 41% of surveyed organisations had experienced a suspicious or confirmed AI-related incident.
The organisations best prepared for this threat will not be those that expect every employee to identify every fake. They will be those that build verification into their daily work, make escalation easy and ensure that no sensitive action depends on appearance alone.
This opinion piece is authored by Nikita Astionov, Founder & CEO, Cyronel.
Source: Tahawul Tech