Today on our Tech for Business podcast, it is
Cybersecurity Awareness Month, and we're going
to dive into the lovely buzzword of deepfakes.
So we're joined by Todd, our COO and CISO, and
Nate, our Director of Cybersecurity. I think
our listeners know what deepfakes are, but I
guess we could give them the elevator pitch and
maybe just some examples of where they might
see it or where you have seen it. I can open
up this time. So deepfakes are when you use artificial
intelligence to impersonate someone. Right. This
goes back quite some time. I remember seeing
a video from Adobe when they were first introducing
some of their voice cloning technology. Right.
At the time, it was mind blowing because they
would kind of record the audio from the presenter
and then they changed the the the words they
were able to type it out and have it speak back
and I think on that on stage they changed it
to basically say that that the speaker kissed
someone other than his wife or something and
everyone's mind was blown that how dare he say
something along those lines right that was like
10 years ago I don't I don't have the day we
can find that but The tech has greatly evolved
right you know by this point. I think everyone
knows AI is here It's it's revolutionizing kind
of how we work how we think that type of stuff
Where the deep fakes have done really good now
is video so in the past audio was easy You know
you you don't need to do much to impersonate
a voice There's even free services on this and
I've I've done printing sessions on Grandpa,
if you ever receive a call from me sounding like
I'm in jail, let me run. Don't pay the demand,
right? But with the video is where now it's starting
to blur the line of what's reality and what's
not. So if you spend any time on the internet,
like let's say Reddit or YouTube or Facebook,
this information is running rampant with the
fakes. Where we start to see this also become
dangerous is that there's also been articles
out there that will say North Korea is using
deep fake technology to gain jobs at U .S. tech
companies to then further, you know, basically
what they're doing is they're taking this technology,
sorry, they're using deep fakes, gain jobs, receive
a salary, which then is going back to the North
Korean weapons program. And that's essentially
how they're now siphoning money from the U .S.
to fund their activities. Yeah. Todd, is this
something that the average business owner should
be concerned about? Or is this kind of like an
enterprise business issue? Well, I would say
I'm sure there's all kinds of examples. I was
kind of trying to figure out what to add into
it. And I and I. Bear with me as my train of
thought goes running rampant on me and I was
kind of going What's the difference between a
deep fake and an AI slop? But if I answer the
other question is I mean, there's so much stuff
that's AI driven and it's it's mildly interesting
to me as I Scroll through social media or whatever
the case may be and there's currently enough
obvious stuff where I'm like, well, that's that's
obviously AI AI AI I don't think that's going
to last much more than a year and then it's going
to be incredibly difficult to see it. So I think
the threat is real. And I do think every business
owner needs to be aware of it. Now, whether it's
as relatively generic as something as we're just
trying to pull some revenue from an organization
to help funnel our desires, maybe one thing,
but it could be something much more heinous than
that too, right? I mean, in theory, if you're
hiring an IT individual remotely, And that person
now gets credentials to your network, your host.
But it could be anything else too. I mean, we
had a retirement party at the office this morning,
and somebody had mentioned they were buying a
bunch of gift cards with their reward points.
And someone was like, well, great. When the CEO
asks for you to get a whole bunch of gift cards
for them, you're all set. Keep going down this
path because you know what happens when it's
a video of your CEO Hey, I need you to help me
out Nate. Can you get me some gift cards? Those
kinds of things are completely possible, right?
It's your voice. It's your face. It's everything.
It's the mannerisms So yeah, I think the thread
is real. It is something that is it's something
that everybody faces You know, I've done speaking
engagements in the past and they kind of mentioned
the one with his grandfather is there is a generation
of people in the United States and probably everywhere,
where they are pretty unsure of what's going
on from a technology aspect. And something like
this can be used to siphon millions of dollars
away from a certain demographic of our nation.
So not just business -wise, I think it impacts
everybody. I know this is getting a little bit
deeper into it. So we can come back to your question
as well. I do want to call out, it's not all
nefarious either. There are legitimate business
cases where deepfakes may be useful. Joking aside,
let's say, you know, Ariel already has a lot
of content of me talking and speaking, right?
We've rehashed certain ideas. So there's multiple
ways that I've said things. This would be a great
time to fire me and just say, I'm going to now
have a AI deepfake Nate for the podcast and save
money, right? So what? But I say that because
we are starting to see a lot of marketing campaigns
switch to using AI generated video. Maybe it's
not a deep fake necessarily, but AI video again
has become really good at this point. So there
are still some telltale signs that maybe we can
talk about of how to identify this stuff in multiple
avenues. But. When it comes to. legitimate business
cases is now you're seeing advertising agencies
save significant amounts of money because they
don't need to go to a casting director or hire
the actors develop the script anything like that
they just have to say put in a good -looking
individual that looks like this in this type
of scenery and says these things and they might
get a really nice video with only a couple hours
at work, and it still provides the same type
of impact to its consumers. No, you've got other
things, but I can't help it. I don't want to
get into specifics because I don't want to raise
any alarms, and I don't want anybody to get upset.
But I've seen videos, and Nate kind of mentioned
this, so I'm tipping my hand slightly a little
bit, but there's a video of a very prominent
political figure in the United States where it's
pretty obvious there's been posts where they're
doing, whether you want to call it the AI avatar
or other, it looks like them specifically but
if you watch the video you can see certain things
so they do hand gestures and in case you're not
on video I'm doing hand gestures and two of the
fingers on one of his hands so now I notice he
blends into one so those are the kinds of things
that are going on there but but if you weren't
really looking for it you probably wouldn't have
even noticed but it's happening so it's it's
happening today there is real stuff that's out
there that that avatar it's just quick it's easy
it's getting the right message across in the
same fat manner that you wanted to so it does
exist i actually saw an article and i did not
dig into it this morning uh but i saw that there
is an ai actress kind of to nate's point that's
drawing a lot of interest from hollywood and
i was like well how how does an ai actress draw
interest from a studio anyways if you're curious
the name is tilly norwood i believe um but the
This is an AI actress. And to Nate's point is
it's pretty quick that you can start to use this
type of technology to do all kinds of stuff,
new movies, new whatever. And it can be a totally
generic individual. That's interesting. I'll
have to look that up because just like who has
ownership over that, you know, there's like probably
a marketing or an artist person on the side.
It's such an interesting concept. I'd love to
dive into sort of spotting these things. and
what you're looking for, Todd kind of transition
us in that direction. So when you're dealing
with, you know, interviews or phone calls or
things like that, what are really those big things,
big red flags? Yeah. So with this is becoming
a challenge because AI is getting better. So
I'll talk about it as in, you know, within the
last six months or so is AI, sorry, people are
predictable, but they also differ right from
time to time. So I have a common cadence to my
tone and how I communicate. But every once in
a while, I will change things up right on the
fly without having to have any rhyme or reason
of why I do so. Now the AI is going to kind of
common patterns and try and stitch that together
and you can tune it to maybe sound a little bit
different. Sometimes it will struggle with certain
intonations. Maybe, you know, it always gives
it a hard T or a hard S and it might sound a
little bit jarring. Other times, it'll often
put the same spacing in between each words. And
so the computer is basically taking a word, plopping
it down, taking the next word, plopping it down,
and it's reading it like a book, right? There's
always one space. What we know is that people
will sometimes put longer pauses like that. And
so that's where people become a little unpredictable.
So if you can follow something that sounds like
a very common cadence or, you know, standard,
you know, repeatable cadence, it could be a telltale
sign. One of the other traits of audio is if
you are interacting with a deep fake. it has
to do its processing on the back end to be able
to respond back. And so if I were to go ask you
a question and you pause for one, two, and then
respond, then at that point it could be a defake.
Maybe, maybe not. The one thing I do want to
be careful because I was just doing some interviews
over the past week is while you're trying to
identify potential defects, which again are going
to be that common, Do not inherently discredit
someone else's standard cadence or thought patterns.
There are people that may actually need to take
a second or two to communicate or process their
thoughts before communicating effectively. So
I just want to put that in there because I think
there is a lot of bias when hiring and I don't
want to rule out you discrediting good. because
you're looking for a AI deep fake, and then coming
to me saying, Nate, he told me that this person
is fake, right? I think it's really important
to kind of highlight what Nate said, so I'm going
to do it again. As of the first week of October
in 2025, this is where we stand with spotting
it. And I say this because I went to a conference
back in May, so we're not too far along back,
and there was some AI stuff that was going on,
and I was like, that is so... ridiculously obvious
that it's AI. In this one example, there was
no blinking. None. The AI did not blink once,
and I was like, well, that was so ridiculously
obvious as to the fact that that's not real.
You don't even see that. It's only been a couple
of months. That's been corrected. That doesn't
exist anymore. So just kind of highlighting,
this is a moment of time. This is where AI deep
fakes are at the moment. Some of the stuff, depending
on what you're looking at, I think you'll see
varying results. For example, on social media,
as I said, is your doom scrolling or whatever.
Some of the things that are fairly obvious, the
skin tone tends to be weird. The lighting tends
to be odd. You get shiny reflections that don't
make sense. People are unnaturally beautiful
and have perfect bodies. They're fairly obvious
when you're looking at it. You're like, that's
not real. No advertising agency would ever pick
me. But those ones are relatively easy to spot
as of today. Now, things that still do happen
is you'll see weird eye movement. You will see,
as Nate mentioned, there'll be some some herky
jerkiness. I think the if you're interacting
one. The one that Nate mentioned, the pausing
is pretty obvious. To me, it's fairly obvious.
The other one that I think is kind of funny is,
is one of the things that AI is starting to do
to kind of cover up the strange cadence is it'll
put in a, every once in a while, you're like,
that doesn't actually fit there. That's bizarre.
So those things kind of will be pretty obvious.
Again, at the moment, there is some of the light
lip syncing things that happened today. You don't
see that quite as much on video just because
of the inherent nature. where that's off as much
but I think we kind of nailed the vast majority
of them and again most of this is as of today
I think it's getting better so much quicker but
as Nate mentioned the one that's really obvious
is when you're interacting with it there is a
typical half second one second pause of it's
taking that that message and saying how am I
going to respond it's trying to predict anyway
but it has to make sure it's got it the right
context before it responds so there is usually
a bit of a delay in it. But again, it's not a
perfect solution. You know this is always incorrect
because someone took a moment to gather their
thoughts. There are other telltale signs. I can't
find it right now. I was trying to find it while
you're talking. And it was some commercial for
a drink. I don't know if it was Fanta or whoever.
But when you look at the AI actress's hair, it
doesn't follow the physics that you would expect.
Things kind of float and flow just a little too
much. And if you look at the physics of that,
yeah, that doesn't look great. We know that when
you look at generated content, things like water
doesn't flow well. Hair has historically been
a question of whether or not it's accurate. It's
gotten a lot better. But even in the most recent
AI advertising, it's how much time and money
does that advertising agency want to put in to
make it look perfect? if they already are delivering
the same type of messaging. Right. Yeah. I'll
kind of expand just a little bit too. There are
certain things too, and Nate and I are really
good at it. Ariel would be a much tougher person
to figure out if it's AI, but Nate and I both
have quite a few hands gestures that pop up on
video. So AI is not going to map that out very
well. So I think those ones are fairly obvious,
too. But as I mentioned earlier, there is stuff
where you can see blurring of and blending of
fingers. So another one I saw, somebody had six
fingers on their hand. And no, this is not a
reference to Princess Bride. But it does happen.
There was an article that came out, and already
it's kind of slowly becoming obsolete. they were
talking about when you're interacting with like
a deepfake like in an interview asking them to
do something to like stand up or to move or there
was an article talking about kind of going back
to a little bit more basic technology like if
you're on a phone sending a code word or just
the same thing as like an MFA with someone like
can you say the code that I texted you you know
So can you talk a little bit about what are some
of the steps we can take to make sure we're not
falling for these things? I was trying to find
another article here. We can put it in the show
notes. There's a article about how a North Korean
fake IT worker tried to get hired at Know Before.
So Know Before is a phishing and security training
platform. You know, many of our customers use
it. There was some anomalies that kind of showed
up when trying to work with this individual.
I don't remember all the specifics because I
remember it was from last year. But I would say
a couple of the items is how do you monitor output
of your employees? Right. So let's say, yes,
you hired a deep fake in North Korean. you know,
tech workers, it could be anywhere. What type
of output are they getting, right? Interesting,
yeah. You should have some way of measuring employee
success. Now, I am vehemently opposed to what
I consider spyware of just putting on all your
employees' software or your computers and taking
screenshots and keyloggers. I think that's wrong.
You should have a good way of measuring employee
productivity without needing to go down that
route. I will call out the safeguards is you
do hire the wrong person. How do you prevent
new software from being loaded onto your workstations
or devices in the event that you do make a mistake
and hire that person, right? This is where tools
like the application allow listing are going
to come into play and very, very critical. If
anyone tries running anything new, are you able
to get an alert saying someone's running new
malicious software in your environment? Taking
a step backwards is, those are all reactionary,
right? Now, what do you actually throw actively
to try and prevent this in the first place? There
are various tools that are coming up of, you
know, okay, let's run a extended social security
trace, you know, taking a look to see, does this
person have a history of predictable employment
history, right? As I see they grabbed a couple
of, we're based out of Minnesota here, so. Have
they worked at several Minnesota -based jobs
or are they kind of a global nomad picking jobs
wherever they may be? It's not a disqualifier,
maybe a red or a yellow flag to consider. What
about some type of background check? Does it
come back with much history or not, right? Is,
sorry, not employment records, but, you know,
residence records, you know, do they kind of
follow a standard pattern of where they've lived
or are they just popping up again all over the
world and maybe those don't always align with
the employment history. So if you're a technical
recruiter or an HR individual, you've got more
work to do, I'm sorry. And now you are playing
into a little bit of this anomaly detection.
There are tools out there, partnering with any
of them, you know, for this podcast or anything,
that do partner in with your HR background check
software to provide additional validation. And
even on calls, maybe like a Teams call or a Zoom
call that can identify when there is some type
of anomaly. And on the fly on the side, say,
suspect a deep fake. Maybe either stop the call
or to aerial your point. Hey, can you stand up
for a second? You know, and provide that additional
challenge. Yeah, all excellent things. I think
the interacting in a video is very specific.
I mean, there are other things that I think are
worthy. So if you're doing, this is just general
stuff, right? If you're getting AI content, you'll
often see the hyphen in the middle of words.
If you're like, people don't hyphen like that,
AI does. So there's things like that too, but
I think the video example of doing something
unusual, some unusual emotion is a great first
thing. The other really good one I would have
is stay skeptical just in general. It does make
sense. One of the other things that I would typically
keep front of mind is the interview is also very
specific, but historically I would say AI, a
deep fake in particular, it's a method of social
engineering. What you're going to see with it
is the same thing that you almost always see,
which is there's going to be a sense of urgency.
There's always going to get you to try and do
something. And so all the things that we've preached
in the past when it comes to social engineering,
you still need to be aware of. Doesn't matter
that it's a video now. It's just, you know, why
am I feeling this pressure? Why is this getting
amped up? What's going on? And use the typical
methods you'd have to kind of de -escalate the
situation. I mean... ultimately your typical
good security things need to still stay in place
so you know if someone's trying to get money
from you or get logging information if it was
somebody trying to interact with you like they're
the IT department making sure you've got multi
-factor authentications and then all of all those
things all still make sense they're all super
urgent things that you need to be doing so don't
take your eye off the ball just because you got
a video interface with somebody I wanna make
sure you both get a chance to share anything
that you'd like. But earlier in the podcast,
we referenced using fake or I would say generative
AI in this case more ethically for marketers
or creators or businesses that do want to use
these tools in a professional and ethical way.
So what are some rules of thumb you would share
if a business wants to use this technology? Well,
sorry, I'm going to start with the ethical guidelines,
the guide rails, if you will. Hypothetically,
it doesn't matter if it's an internal person,
and I'll just say, like Nate did, I'll use myself.
If you were going to use an AI avatar of myself,
you need to make sure that the consent is there,
that I absolutely agree that it's OK that you
can use the likeness in this manner. You want
to make sure you're not misleading or harming
the individual or wherever you're going with
it. You probably should disclose that this is
synthetic media. So those just are kind of general
guide rails of you should probably at least start
here. But when it comes to examples, I think
the best one that I have that I go that that
makes a ton of sense would be marketing. So for
example, in a situation like this where we would
say this is very expensive for us to have myself
and Nate on a podcast. And we want to limit that
expense and or Nate and Todd are super busy or
Nate and Todd went on a cruise in the Caribbean
for a security event. Any of those reasons would
be good reasons to have an AI avatar to come
in and help out with the podcast. You know, another
one that pops in my head is similar, right? It
would be like a training situation where it's
it's front of the classroom. Let me get a quick
video in. That would be another good example
for me. I've been trying for two years to get
Todd on that security cruise. So I think that's
an implication or next year we're going. So come
February or so, if you see an aerial mark, this
is synthetic video. You know, Todd and I are
working hard on a cruise. With, I'll touch on
some of the laws. So no surprise laws laying
behind tech. The last time I checked, again,
I'm not a lawyer and I don't. regularly stay
on top of the most latest laws. But the last
time I had checked, which I believe was back
in May, it was not illegal to use deep fake technology.
Now, you know, where it comes in to Todd's point
is the things like libel and that type of stuff.
It is illegal and they do call it out to use
deep fake technology to influence the election
campaigns and results. So the laws have already
caught up to that part of it. So but yeah, in
general. there are ethical guidelines that we
should all adhere to. Technically, you can do
most of whatever you want, right? So to your
point in where you would want to use this, internal
resources would be a great use of this. So how
much time does it take to provide internal training
to your employees? That's also very expensive.
We know that the cost to onboard a new employee
is approximately one and a half times their salary
right there's there's plenty of studies out there
that you can go look at and so and the reason
why is you have that initial employee and you
have to take you know their mentor trainer and
go run them through that entire training to bring
them up to speed lost efficiencies what if you
could take your written content that you've already
generated and i'll pick on ai a little bit is
a Copilot, Gemini, whatever platform you're using.
Go generate a basic call script and how to interact
with our customers, right? Now you can take that,
run it into another technology that does video
generation and say, turn this into a training
for new employees, right? I want you to be personable.
I want you to, you know, connect with them, make
them feel welcome, right? Now you've essentially
have a onboarding trainer that's AI driven or
deepfake driven. You don't have to go pay for
an employee to sit there and record those videos
either. And at the end of the day, it doesn't
really matter whether or not you have it or not.
That's just a nice small touch to make an employee
feel a little bit more welcome rather than just
handing them a big document and say, read the
72 pages that we wrote up for you, right? So
little touches like that can go a long way. I
mean, AI is amazing. We love it. It can do amazing
things. As we close out here, the thing that's
on my mind is, do you think there will come the
bell curve and kind of the other side of this
where are almost capitalizing on not using AI.
Now, is there going to come a point where low
tech is going to be popular? Go ahead, Nick.
Yeah, sorry. I want to reference back the old
podcast. I don't have the exact one. I'm subscribed
to CIT's YouTube and it comes across, you know,
as aerial blasts of all of our podcasts. But
there was one about AI and tech. So I want to
call out for CIT, right, to summarize. class
that technology and automation go hand in hand,
right? AI and automation go hand in hand. But
at the end of the day, our customers expect a
human response to be able to get the context,
get the awareness, hear your frustrations with
tech, right? That's why we're here to help solve
the business problems and get tech out of your
way to be able to assist with that. Now, if you
have to talk to an AI that's missing all that
rich context, that's not going to help you. So
there is value of still driving the human touch
to things. The value of AI and some of these
deepfakes and you know, that type of stuff. Again,
kind of like the training documentation that
I called out is help use that to automate the
efficiencies to things that don't really matter.
Right, but the things that are critical to the
business or critical to how people interact with
you always have the human touch. Yeah, my answer
would be I think it's inevitable that there will
be something that comes in and it's, you know,
kind of like the probably a terrible analogy,
but the first one that came to mind is made in
America, right? Or organic food might be another
one where there was kind of this call of going
back to this natural way of doing things. the
actress that I mentioned earlier would be another
one where you'll want to say you know this video
was made with only humans only those kinds of
things it seems inevitable that yeah you will
definitely see some push that says I want it
to be a human that I'm interacting with you know
there there will be somebody like if you're using
AI as a potential thing where you could potentially
do this or you can use it for taking phone calls
right you don't like talking to the computer
and people are yelling on the phone representative
representative you may find somebody I will not
do business with somebody where I have to talk
with an AI voice to get to a real person. I think
that would absolutely happen. For sure. I think
one of the other things is AI, right? It's always
so validating back to you because it wants to
keep you engaged, right? There's a full open
AI lawsuit about this right now. It's always
making you feel good to try and keep you on the
platform. I'll pick on tech and on the help desk
side of things as well as sometimes when you
call in for support, you don't want to hear the
tech go, how are you? You're having a great day,
right? You just want them to go, I understand.
Yeah, something's messed up. Let's let's just
knock it out. Right. I don't know if the A .I.
is going to get to that point and just be real
with you. But that's where I think that human
touch is, again, really important. We're not
trying to validate. every emotion, we're just
trying to touch on it, help you out, reduce the
frustration, but ultimately solve the issue so
you don't have to deal with it again. Perfect.
Yeah, that's a great place to kind of end that
highlight between balancing the human element
and all of these new amazing AI tools. So thank
you both for joining us this week. Thank you
for joining us today. If you enjoyed this topic,
please let us know. Like, subscribe, or reach
out to us at info at cit -net .com or head out
to our website cit -net .com slash podcast. We'll
be back next week with an all new episode.