This guest post was contributed by Amit Shuster, VP Product, Vetric.io
Cybercriminals have always targeted senior executives. What’s changed is how effectively they can now impersonate them.
Deepfake technology has matured to the point where an AI-generated video of a CEO endorsing a fraudulent investment scheme, or an audio clone directing an employee to wire funds, can be nearly indistinguishable from the real thing. Deloitte estimates deepfake-enabled fraud losses could reach $40 billion annually in the U.S. alone by 2027. That number should concentrate minds.
But the bigger problem isn’t the fakes themselves. It’s that most organizations have no way to catch them.
The social media monitoring tools most companies rely on were built for a text-based world: they scan keywords, hashtags, usernames, and account metadata. That worked when the threat lived in the caption. It doesn’t work when the threat is in the video itself.
Short-form video platforms have accelerated this shift. On TikTok in particular, captions are often irrelevant – the entire message is delivered verbally. A fraudulent post can direct viewers to a scam link, impersonate an executive by name, and replicate their voice or likeness, all while its accompanying text triggers nothing in a conventional monitoring system. The attack is invisible to tools scanning for it in the wrong place.
This is deliberate. Threat actors have learned where the blind spots are.
What detection actually requires
Catching these threats means analyzing what’s being said and shown, not just the metadata around it. That requires audio transcription, voice and likeness matching, and video analysis, applied continuously, at scale, across platforms that each have different technical formats, moderation processes, and enforcement timelines.
Volume is the practical challenge. A single executive with significant social media presence might generate thousands of potential monitoring signals per day across platforms. Effective detection needs to surface genuine impersonation attempts without burying analysts in false positives, which means prioritization and risk scoring, not just alerting.
Evidence handling matters too. Takedown requests require documentation, and the strength of that documentation affects how quickly platforms act. Some have mature trusted reporter programs; others don’t. Regional differences add further complexity.
Takedowns are not the finish line
Perhaps the most underappreciated aspect of executive impersonation is what happens after a piece of malicious content comes down. In most cases, threat actors simply recreate their accounts and start again. Enforcement action is a speed bump, not a resolution.
This means executive protection has to be treated as a continuous monitoring operation, not a series of incident responses. Organizations that treat each impersonation as an isolated event will always be a step behind.
Text-based signals will remain useful, but they are increasingly insufficient on their own. Spoken and visual content now carry the threat – which means security and intelligence teams need to treat video as source material for threat detection, not just the medium it travels through.
The organizations that get ahead of this are the ones that close the gap between where threats actually operate and where their tools are looking.
