Protect yourself against AI and deepfake cyber threats

Artificial Intelligence (AI) is being used more often in cyberattacks, including deepfakes, which are manipulated videos or audio that make it appear a person is saying or doing something they did not. These attacks pose growing risks for governments, businesses and individuals.

A recent case showed how damaging this can be: an AI-generated deepfake impersonated company leadership and convinced employees to transfer $26 million to scammers. Other attacks have used deepfake audio generated from just 15 seconds of a person’s recorded speech.

While AI has been around for decades, its new applications in cyberattacks are increasing in scale and speed. Understanding these threats and preparing for them is critical. These threats can feel difficult to defend against, but governments can take practical steps right now. The following actions will help reduce risk and strengthen your defenses.

Three steps to protect against AI-driven cyber threats

1. Improve your ability to detect deepfakes. Employees need training to recognize that content may not be authentic. Warning signs include:

• Inconsistencies in audio or video quality
• Mismatched lip movements and voice
• Unnatural gestures or facial expressions
• Unusual word choice or behavior
• Missing or unverifiable sources
• Lack of watermarks on images or videos

Training should include practical exercises and opportunities to practice spotting these red flags.

2. Strengthen verification procedures. Even when content looks or sounds real, employees should verify before acting. Policies should require extra steps such as:

• Calling the sender directly using a known phone number
• Delaying urgent requests until details are confirmed
• Reviewing suspicious instructions with a supervisor

These procedures help prevent attackers from exploiting rushed responses.

3. Adopt a layered defense approach. Combating deepfakes and other AI-driven attacks requires multiple strategies. Governments can:

• Use new detection technologies
• Update and enforce cybersecurity policies
• Provide regular employee awareness training

Why it matters

Cyber criminals continue to develop new ways to use AI. By combining technical defenses, clear policies and employee training, local governments can better protect themselves against these evolving threats.

SAO’s #BeCyberSmart program offers free cyber checkups to local governments

Cyber checkups provide a fast, free and independent assessment of your government’s vulnerability to common threats, along with actionable steps you can take to improve your overall cyber health. If your organization needs help improving its cybersecurity posture, or has cyber related questions, email Center@sao.wa.gov.