AI made it cheap to impersonate anyone at a company. Most companies still protect a handful of executives, by hand.
With today’s AI tools, building a convincing fake executive takes minutes: a social profile with the CEO’s photo and writing style, a lookalike domain, a message that sounds like them. And people fall for it. The FBI’s Internet Crime Complaint Center put 2024 cybercrime losses at $16.6 billion, up 33% from the year before, and business email compromise alone accounted for $2.77 billion.
Our 2026 State of Executive Impersonation Report, based on tens of thousands of impersonation alerts across the executives we monitor and protect, found that attackers now use AI to impersonate leaders on the open internet, outside the reach of a company’s internal security tools. The attacks have scaled. Most protection has not.
Impersonation scaled
When a fake costs almost nothing to make, attackers can afford to make a lot of them. For one investment holding company, we scanned more than 11,000 social profiles and removed more than 400 impersonations of its CEO and the firm.
The reach has grown too. According to the 2026 State of Digital Risk Report, which Outtake produced with Cybersecurity Insiders, 53% of organizations had an executive or employee impersonated in the past year.
This will keep growing. Attackers will increasingly go after what is hardest to patch: people. If you can’t break in, you persuade someone with access to let you in, and impersonating someone they trust is the most direct way to do it.
Protection didn’t
Most executive protection is still built for a smaller, slower problem.
It watches the wrong places. In our sample, social and video platforms accounted for nearly nine in ten impersonation alerts. Lookalike domains, the part closest to the email systems security teams already monitor, made up less than 4%. Email is often where the loss lands, but the impersonation that makes the request believable is happening elsewhere.
It moves too slowly. A convincing impersonation can go live in minutes. Most protection programs still respond in days, and the damage happens in between.
It covers too few people. The Digital Risk Report found that 77% of organizations limit coverage to executives, a few high-risk roles or case-by-case response, and only 16% have formal protection covering most or all employees.
It depends on people working through tickets. When a fake is found, communications handles the profile, legal handles the domain and fraud handles the scam. More than 60% of organizations lack adequate capability at every stage of the threat lifecycle, from detection through measurement.
That is the governance blind spot. The attack now moves at machine speed across platforms security doesn’t watch. The defense still covers a short list of people and depends on teams working through tickets.
What to do
- Keep training, but don’t rely on it. AI makes fakes hard to tell apart from the real thing, so even well-trained employees will miss some. Add checks that don’t depend on judgment: official channels, and a second-channel confirmation for wires, payment changes, investor communications and job offers.
- Defend outside the company. Most of this activity happens on social platforms, video platforms and lookalike domains, so monitoring that stops at email will miss most of it.
- Hold any defense to the new standard. Whether you build it or buy it, it should keep up with frontier technology and cover everyone an attacker could impersonate, not just a short list of executives. If AI is increasing the volume of impersonation, you need a tool that can detect and take down impersonations fast enough.
Make falsehood expensive
Trust is an economics problem. When faking someone is expensive, trust holds. AI has made faking cheap, so the job now is to make it expensive again: hard to keep a fake running and easy for anyone to check what is real.
That will matter more each year. The companies that adapt will be the ones built to handle a volume of attacks we have never seen before.
Join our LinkedIn group Information Security Community!
