How Exposed Is Your Organization to Deepfake Social Engineering?
How Exposed Is Your Organization to Deepfake Social Engineering?
Ten questions, two minutes, one honest score. Then the 7-rule verification standard and six runbooks that close every gap the scorecard finds. Built from orchestrated deepfake and AI voice simulations run against real enterprise teams.
Three-page PDF · No form · By Jason Thatcher, Founder and CEO of Breacher.ai
in AI-related losses reported to the FBI in 2025, the first year it was tracked separately
FBI IC3 2025 report
moved after one video call where every other face on screen was synthetic
Arup, Hong Kong, 2024
is all it takes when a single approver acts on a convincing voice without verifying the request
Breacher.ai simulation findings
Score Your Deepfake Exposure in Two Minutes
Answer for what actually happens, not what the policy says. Each Yes is one point. Each No maps to a runbook or rule that closes it.
- 01FinanceEvery payment or bank-detail change is confirmed by calling back a number already on file.
- 02FinancePayments above a set amount need a second approver, with no exceptions for executives.
- 03Service DeskPassword and MFA resets never rely on knowledge questions alone (ID, manager, date of birth).
- 04Service DeskAll active sessions are revoked after any password or MFA reset.
- 05All StaffStaff know IT never asks for codes or remote sessions on an inbound call.
- 06All StaffStaff never return a voicemail to the number left in the message.
- 07HR / HiringRemote hires pass a live ID check matched to the person before an offer.
- 08LeadershipThe CEO has told staff in writing they can pause any request without penalty.
- 09ReportingThere is one simple way to report a suspicious call or video, even stopped ones.
- 10TestingHigh-risk workflows were tested in the last 12 months with realistic voice or video.
Three Pages. Score, Standard, Runbooks.
No fifty-page whitepaper. A working playbook your finance, service desk, HR, and executive teams can adopt this quarter.
10-Question Exposure Score
Ten controls across finance, the service desk, all staff, HR, leadership, reporting, and testing, with three clear risk bands.
The 7-Rule Verification Standard
One organization-wide standard for every request that moves money, changes access, or releases sensitive data.
Six Scenario Runbooks
What the person on the receiving end does the moment a scenario starts, each mapped to the questions it closes.
The L0 to L5 Action Ladder
Score the deepest step a person reached, from no response to an action that hit the business, then re-test.
Verify the Request, Not the Face
Your people will not out-listen an AI voice or out-stare a live synthetic face. A process that verifies the request through a trusted channel works no matter how good the fake gets.
Judging by ear and eye
- Depends on the quality of the fake
- Weakens with every model release
- Fails silently: a good fake passes
Invoking the procedure
- Depends on your process, which you control
- Holds no matter how good the fake gets
- Fails visibly: a skipped step you can fix
The playbook keeps what works. Inspectable tells such as look-alike domains and mismatched senders stay in training, and technical identity verification stays in your hiring path. The playbook covers the moment a request reaches a person. For the full argument, read The Deepfake Defense Guide and why deepfake detection training is a decaying control.
The 7-Rule Verification Standard
For any request, on any channel, that would move money, change access, or release sensitive data.
- Define high-risk requests. Payments and bank changes, password and MFA resets, access, sensitive data.
- Never verify inside the channel the request came in on. Not the same call, not the same thread.
- Call back on a number you already had. Never a number, link, or invite the requester supplied.
- A live face or familiar voice is not proof of identity. Treat it like an unknown sender.
- Urgency and secrecy add verification. "Keep this confidential" means a second approver.
- Anyone can pause any request without penalty. Leadership says so in writing. Closes Q8
- Report every attempt, including the ones you stopped. Closes Q9
Fix Every No
Each runbook is what the person on the receiving end does the moment the scenario starts. The PDF maps every one back to the scorecard.
"IT support" calls an employee
Routine pretext, expiring credential, often after an email flood.
Share nothing. Say the line, hang up, call the service desk on the intranet number.
An "employee" calls the help desk
Locked out, new phone. Knows their manager and ID from public sources.
No knowledge-only resets. Call back on the HR number on file. Revoke sessions after.
Voicemail asking for a callback
The voice that answers is patient and helpful, and possibly an AI agent.
Never call the number left. Look up the department yourself.
Executive payment request
The CEO or CFO on video, asking for an urgent, confidential transfer.
End the call. Call back on the directory number. Second approver, no exceptions.
Synthetic job candidate
A strong remote candidate whose video does not quite add up.
Live ID check before the offer. Ship equipment only to a verified address.
Vendor or payroll bank change
A known contact updates banking details right before a big payment.
Callback to the number on file, second approver, hold the first payment.
Measure the Action, Not the Click
A voice call has no link to click. Score the deepest step each person reached, then re-test after every fix.
Built for the Teams Adversaries Call First
Finance and AP
Executive payment requests and vendor banking changes, with callback and second-approver rules.
IT Service Desk
Password and MFA resets that never rely on knowledge-only checks.
HR and Recruiting
Synthetic candidate controls before the offer and before equipment ships.
Executives and EAs
A written "pause without penalty" standard that removes the fear of slowing a leader down.
Written by the Team That Runs These Scenarios
Breacher.ai runs orchestrated deepfake and AI voice simulations against enterprise organizations. The playbook is shaped by what we see on live engagements.
The false green flag
A calm "service desk" call about an expiring credential trips none of the red flags awareness training teaches. It reads as routine.
The callback is the soft spot
Voicemail drives a relaxed inbound callback, and that zero-pressure call is where the most consequential actions happen.
Process beats the operator
One sentence, said and then followed through, most reliably ends our simulations: "I need to verify this with our internal team."
"A workforce that invokes process defeats our red teams. Users that spot fakes do not consistently."
Jason Thatcher, Founder and CEO, Breacher.aiScore It. Fix It. Prove It.
Answer honestly
Run the ten questions with finance, the service desk, HR, and leadership in the room. Score what happens, not what the policy says.
Close every No
Adopt the 7-rule standard, then roll out the runbook mapped to each No. Start with Runbook 01, the highest-risk scenario.
Test under pressure
Run realistic voice, video, and callback simulations, score them on the L0 to L5 ladder, and re-test after every fix.
Get the Deepfake Defense Playbook
The scorecard, the verification standard, six runbooks, and the action ladder on three printable pages. Free, no form.
Download the PlaybookTurn Your Score Into Proven Controls
A scorecard tells you what exists on paper. The OSES™ platform shows you whether it holds under realistic pressure.
Test every runbook against a live scenario
- Orchestrated, multi-stage deepfake voice and video simulations
- Live conversational closes and agentic inbound callback handling
- Findings anchored to procedural controls, not individual blame
- Scored on the OSES™ ladder against your peer vertical
Training built from your own procedures
- Generates awareness modules and simulations in minutes
- Aligned to your policies, procedures, and controls, not generic content
- Drop in a document, like this playbook, and generate training from it
- Available with the platform or on its own
SOC 2 Type I report issued, Type II examination underway. Explore deepfake simulation, vishing simulation, and our AI vishing field findings.
Deepfake Defense Playbook Questions
What is in the Deepfake Defense Playbook?
Three pages: a 10-question exposure scorecard, the 7-rule verification standard, six scenario runbooks that each close specific scorecard gaps, and a six-level ladder for measuring what people actually do in a simulation.
How does the deepfake exposure scorecard work?
Answer ten Yes or No questions for what actually happens in your organization, not what the policy says. Each Yes is one point. A score of 0 to 4 is Exposed, 5 to 7 is Inconsistent, and 8 to 10 is Defined. Every No maps to a runbook or rule that closes it.
Who should use the playbook?
Security leaders who own social engineering risk, plus the teams that handle consequential requests every day: finance and accounts payable, the IT service desk, HR and recruiting, and executive assistants.
Is the playbook free?
Yes. It is a direct PDF download with no form to fill out.
Does the playbook replace deepfake detection technology?
No. Technical identity verification, such as document checks and liveness testing in the hiring path, stays in place. The playbook closes the gap that remains when a request reaches a person, by binding every consequential request to a verification procedure that holds no matter how convincing the voice or video is.
We scored 8 or higher. What now?
Prove it. A Defined score means the controls exist on paper. A live simulation with realistic voice, video, and callback scenarios shows whether they hold under pressure, scored by the deepest action each target took.
Sources
- FBI 2025 Internet Crime Report: AI-related complaints and losses (PYMNTS, April 2026)
- Arup deepfake video conference fraud, Hong Kong (CNN, May 2024)
Find Out Which of Your Controls Hold
We run the scenarios from the playbook against your finance team, service desk, HR, and executives, score them on the OSES™ ladder against your peer vertical, and show you exactly which procedures held.
Latest Posts
Table Of Contents
About the Author: Jason Thatcher
support@breacher.ai
