In early 2024, a finance employee at the engineering firm Arup joined a video call with the company’s chief financial officer and several colleagues to discuss a confidential transaction. He had been suspicious of the first email. The call reassured him: he recognized the faces and the voices. Over the following days he made fifteen transfers, about 200 million Hong Kong dollars, roughly 25 million US dollars. Everyone on that call except him was a deepfake. Hong Kong police described it as one of the first cases of its kind; Arup later confirmed it was the firm involved.

Read the case again and notice what the attackers did not do. They did not break into a system. They did not exploit a bug. They walked through the organization’s own reflexes: a senior title, a confidential matter, colleagues nodding, urgency, and a finance process that let one person move that much money because the request looked like it came from above. The technology made the impersonation cheap. The organization did the rest.

AI-enabled attacks — the cloned executive on a call, the flawless invoice from a “supplier”, the instruction hidden inside a document your own AI agent reads — do not go through your firewall. They go through the parts of your company nobody owns: the mailbox nobody reads, the supplier record nobody maintains, the approval that exists on paper. Readiness is not a security product. It is three things a CEO controls directly: a list of every part of a workflow with a named owner, a written gate on money, commitments, and credentials that no urgency can bypass, and a red-team of any workflow before an agent is allowed to run it. That is the same harness that makes AI reliable in the first place.

Your immune system attacks the wrong things

I write a lot about the corporate immune system: the processes, incentives, and habits that reject change while sincerely protecting the company. Here is its mirror image, and it is uncomfortable.

The same organization that will find fifty reasons not to change a workflow will wire 25 million dollars to a stranger, because the request arrived through the channels the immune system trusts. Hierarchy: it came from the CFO. Confidentiality: don’t ask around. Urgency: the deal closes Friday. Social proof: everyone on the call agreed. An attacker with a voice clone and a video model does not need to defeat your defenses. He needs to sound like your defenses. The antibodies that would have killed an internal proposal to change the payment process waved him through, because he used their own vocabulary.

A company whose immune system fights change but not fraud has it backwards. The fix, it turns out, is the same in both directions.

Attacks travel through parts nobody owns

When I run the Cut with a CEO, we list every part of one workflow — steps, rules, approvals, fields, reports, roles, systems, clauses — and ask two questions of each: who asked for this, by name, and what breaks if it is gone tomorrow. The purpose is to delete what nobody owns before anyone automates anything.

Do the exercise on your payment workflow and something else appears. A part nobody owns is a part nobody watches. The shared mailbox where supplier invoices arrive, which three people can read and none is responsible for. The supplier master data that was last verified when the supplier was onboarded, by someone who has left. The “second approval” that is technically required and habitually clicked. The exceptions path for urgent payments, which exists because a real emergency once happened and has been used for every fake emergency since. None of these are software vulnerabilities. All of them are where the fake invoice, the changed bank details, and the deepfake call land.

So the parts inventory is also your attack-surface inventory, and deletion is the cheapest security control there is. A part that does not exist cannot be impersonated. An exceptions path that has been removed cannot be invoked by a stranger. Every ownerless approval you delete is one fewer place where “the boss said” works.

The gate you refuse to automate

The one document I ask every executive to write, whether for a company or for their own work with AI, names the gate they refuse to automate: the decision that will always pass through a named human, whatever the pressure. For a company it is nearly always the same three things: money leaving the firm, commitments made in the firm’s name, and credentials.

Written properly, that gate is your fraud control. It says who releases a payment above a threshold, by name. It says that a change of bank details or an urgent transfer is confirmed by a call placed by us, to a number we already have, never to one supplied in the request. It says that no title, no confidentiality, and no deadline moves a request past the gate, and that the person at the gate is protected, not punished, for slowing a real CFO down. And it carries a clause I first wrote for an AI agent and now apply to people too: anyone who finds a way around a human gate must report the workaround and stop.

The Arup employee had a moment of suspicion and no gate to stand behind. The gate is not a control on him. It is cover for him.

Your own AI is now a part

There is a second kind of AI attack, and it is arriving faster than the first. An agent that reads your inbox, your PDFs, and your web pages is an employee who believes everything it reads. A sentence hidden in a supplier’s document — white text, a footnote, an “instruction to the assistant” — can tell that agent to forward a file, change a record, or approve a request, and it will try, because it cannot tell your instructions from the document’s. Security people call this prompt injection. From the CEO’s chair it is simpler: you have added a part to the workflow that nobody has put on the inventory.

The controls are the ones the method already demands before any agent earns autonomy. Scoped access: the agent sees the fields the workflow needs and nothing else, and if we cannot say why it needs a field, it does not get it. Its own identity, short-lived and revocable, so its actions are logged as its actions and not as yours. A rollback path for everything it does. Evaluations that run every day, not once at launch. And the same human gate on money, commitments, and credentials that applies to people, enforced outside the model, so that no document the agent reads can talk it past the gate.

Red-team the workflow before you hand it over

In the method, no workflow moves from the old way to the new until it has run in the shadow of the old one against benchmarks fixed in advance. Add three tests to those benchmarks, and run them before the shadow run starts.

Impersonation: a message that looks like it comes from the most senior person the workflow answers to, with urgency and confidentiality attached. Does it reach the gate, and does the gate hold? Injected instruction: a document containing an instruction to the agent. Does the agent act on it, report it, or ignore it? Exfiltration: a request, through the agent or through a person, for data the workflow does not need. Does the scoping stop it? Each test has a named owner and a pass condition, and a failed test is a part to delete or a gate to write, not a training slide.

I spent thirteen years in reconnaissance and seven building intelligence systems, and the lesson that transfers is not vigilance. Vigilance fades by Tuesday. The lesson is that you reduce the range of surprise with structure: you decide in advance which door is locked, who holds the key, and what you do when someone knocks with a good story.

What this is not

This is not a cybersecurity program. Your CISO, if you have one, runs the tools, the patching, the monitoring, and should. What I am describing is the part only the CEO can do, because it is about how the company decides: which parts exist, who owns each one, and which decisions never leave human hands. It costs a half-day to map and a week to cut. It is also, not by coincidence, the first step of making AI work inside the company at all. The harness that makes your agents reliable is the one that makes you hard to attack. You build it once.

Frequently asked questions

How do I protect my company against deepfake CEO fraud? Write a gate that money, commitments, and credentials always pass through, with a named person behind it: payments above a threshold, changes of bank details, and urgent transfers are confirmed by a call placed by you to a number you already hold, never one supplied in the request. State in writing that no title, confidentiality, or deadline bypasses the gate, and that the person holding it is protected for slowing a real executive down. Then delete the exceptions paths a stranger could invoke.

Why do AI attacks succeed against well-run companies? Because they do not attack systems, they attack reflexes: hierarchy, urgency, confidentiality, and social proof. The organization’s own defenses against change, its habit of deferring upward and not asking around, are exactly what an impersonation exploits. Structure beats vigilance: a written gate holds on a bad Tuesday when attention does not.

What is prompt injection, in plain terms? An instruction hidden inside content your AI agent reads — an email, a PDF, a web page — that the agent follows as if it came from you. An agent that reads documents is an employee who believes everything it reads. The controls are scoped access, its own logged identity, rollback, daily evaluations, and a human gate enforced outside the model.

Is this part of AI transformation or separate from it? The same thing. The inventory of parts, the named owners, the gate you refuse to automate, and the red-team before handover are steps of the method that makes AI work inside a company. Read from the attacker’s side, they are the company’s defenses. You build them once and they serve both.

What can I do this week? List every part of your payment workflow and put a name against each. Delete the ones with no name and no consequence. Write the gate on money in one paragraph and give it to the person who holds it. Then run one impersonation test on yourselves, and see whether it holds.

Samuel Pouyt has spent twenty years building decision-grade systems: eight as software architect for the European Respiratory Society, seven building AI for geopolitical risk forecasting inside a Fortune 500 company, and thirteen as a Swiss Armed Forces reconnaissance NCO. He writes about organizational transformation, specification, and decision-making under uncertainty. The full story →