Camellia Chan is the CEO and Co-founder of Flexxon, a next-generation AI-powered hardware cybersecurity solutions provider.
getty
An infamous experiment from the 1960s revealed an uncomfortable truth about human behavior. Ordinary people (people just like you and me) were surprisingly willing to inflict pain on others when instructed to do so by an authority figure.
Six decades later, the Milgram shock experiment still shapes how we think about human behavior, both because of its methodology and because of its enduring relevance.
Beneath each decision to administer an increasingly powerful electric shock was complicity. The majority of participants simply did as they were told, even when it conflicted with their moral beliefs or despite their initial protests. Guided by an authority figure, we become far more likely to follow instructions that we might otherwise question.
This may explain the power of the deepfake executive and why so few of us pause before complying. Whether out of fear, habit or simply operating on autopilot when the boss asks us to complete a task, we often default to obedience. Perhaps the shock of a deepfake attack is the wake-up call organizations need to address that broken culture.
Autonomous Versus Agentic
Milgram described two behavioral states in social situations: the autonomous state and the agentic state. Coincidentally, these are now two of the most widely used terms in discussions about artificial intelligence (AI).
The parallel is striking. Humans can either direct their own actions (autonomous) or allow others to direct their actions (agentic).
In a corporate environment, clear hierarchies exist. Regardless of how flat an organization claims to be, the CEO, chairperson or other C-suite executives naturally occupy positions of authority. When they assign a task, most people are inclined to complete it without hesitation.
Combined with the culture that exists in many organizations today, employees are often rewarded for completing tasks (especially those assigned by senior leaders) as quickly as possible.
That is exactly what makes them vulnerable to deepfake scams: a culture of "don't ask, just do it quickly."
Why Culture Is The Long Fix, But Awareness Starts Now
These patterns of unconscious compliance—fear, autopilot and prioritizing speed over judgment—point to a cultural problem. Organizations would benefit from addressing it, but meaningful cultural change takes time, commitment and specialized leadership. Unfortunately, scammers are not waiting, and they are more than willing to exploit these weaknesses.
At the individual or departmental level, however, awareness can be strengthened immediately. It starts with three simple steps: stop, stare and question.
Deepfake scams typically follow a familiar pattern: an authority figure, an unusual request and an urgent reason to act immediately. Unless your boss routinely asks you to authorize large financial transactions (in which case, you may want to establish a code word), that combination alone should give you pause. Just as you stop at a crosswalk to check for approaching traffic, build that moment of pause into your daily routine.
Next comes careful scrutiny. Today's deepfake technology can produce remarkably convincing voices and videos, making obvious visual glitches a thing of the past. Instead, pay attention to the details that are harder to replicate. Does your CEO always begin with a particular greeting? Do they call you by a nickname? Would they normally contact you directly? Does something about the cadence or phrasing sound unusual or rehearsed?
Finally, challenge the request. At this point, you are deliberately resisting the natural instinct to comply with someone in a position of authority. It may feel uncomfortable at first and take practice, but it could mean the difference between costing your company millions of dollars and preventing that loss altogether.
Using Technology As Your Ally
Humans are naturally inclined to comply. Changing workplace culture is a significant undertaking, and individuals must consciously reclaim their autonomous decision-making to defend against deepfake attacks. That may sound like a heavy burden, because it is.
Fortunately, technology can be an ally, but it should reinforce good judgment rather than just replace it. You wear a seatbelt before driving not because you expect a crash but because you recognize the risk. It is a deliberate decision made in advance so that if an accident happens, protection is already in place. Deepfake detection should work the same way: It should be in place before the threat arrives, not relied upon as a forensic tool after the call has ended.
Not every solution is equally effective. Organizations should evaluate whether detection works in real time, integrates into existing workflows and provides employees with timely signals when something appears suspicious. The goal is not to make technology responsible for every decision but to provide another layer of defense when human judgment is most vulnerable.
Equally important is what these strategies communicate. When organizations combine awareness training, clear verification procedures and technical safeguards, they signal that defending against deepfakes is a shared responsibility rather than an individual burden. That is where the conversation about culture begins to shift—not through top-down mandates to "be more careful" but by creating an environment where employees are expected and empowered to pause, verify and question unusual requests.
Closing Thoughts
Milgram deliberately placed his participants in an artificial environment of coercion for the sake of science. Fortunately, employees are not confined to the same conditions. They are not permanently trapped in the agentic state. With the right combination of culture, processes and technology, organizations can help people reclaim their autonomy.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
>> Home