By Ann Marie van den Hurk, Mind The Gap Advisory
Only 32 percent of corporate executives believe their organizations are prepared to handle a deepfake incident.
That means 68 percent already sense the gap. And yet most have not done anything about it.
That is not complacency. It is a definition problem.
Most organizations measure deepfake readiness the same way they measure crisis preparedness generally: by how well their teams can respond once the facts are confirmed. That standard has worked for most crisis types for decades.
Synthetic media breaks that model entirely.
Why standard crisis preparedness does not cover deepfake readiness
Traditional crisis response assumes a familiar sequence. An incident occurs. Facts are gathered. A response is authorized and deployed.
Deepfakes do not follow that sequence. They introduce a claim, generate visibility, and begin shaping a narrative before any organization has had the chance to verify what is real.
A fabricated video of your CEO surfaces on social media. A synthetic audio clip circulates attributing a statement your leadership never made. A deepfake livestream impersonates an executive while your actual communications sit behind a verification process that takes hours.
By the time your team confirms the content is false, the story may already be forming publicly.
This is the readiness gap synthetic media exploits. And it has nothing to do with how fast your response team can move once facts are clear. It has everything to do with whether your leadership is authorized to act before they are.
The difference between a response plan and a decision plan
Most organizations have a response plan. Far fewer have a decision plan.
A response plan tells teams what to do after the situation is understood. It assigns roles, sequences actions, and defines communications protocols. It is built for clarity.
A decision plan is different. It defines who is authorized to act under uncertainty. It answers the questions that synthetic media forces before facts are available: Who can acknowledge a claim without confirming it? Who can authorize a public holding posture? Who owns the risk of moving early versus the risk of staying silent?
Without those answers designed in advance, leadership teams discover the gap under pressure. Escalation paths that seemed clear become vague. Authority that felt implied disappears. Permission to act early does not exist because no one built it into the structure.
What follows is familiar to anyone who has watched a leadership team navigate a synthetic media incident. Meetings. Drafts. Silence. A visible gap between internal activity and external posture.
What deepfake readiness actually requires
Real deepfake readiness is not about faster verification tools or better detection technology, though both have value. It is about designing decision authority before disruption arrives.
Organizations that hold control through synthetic media incidents share three characteristics.
They have defined which risks take precedence at which moments. Legal exposure, reputational narrative, and operational accuracy do not carry equal weight at every stage of an incident. Organizations that have worked this out in advance do not need to negotiate it under pressure.
They have determined who can act when facts are incomplete. Early acknowledgment, a holding statement, or a visible response posture can all stabilize a narrative before verification is complete. But only if someone is explicitly authorized to make that call.
They have aligned their risk functions around a decision hierarchy, not consensus. Legal, Security, and Communications each have legitimate instincts during a synthetic media incident. Designed authority means those instincts have a hierarchy, not a standoff.
This does not eliminate uncertainty. It eliminates hesitation.
The leadership question deepfake readiness requires you to answer
Deepfake fraud drained $1.1 billion from U.S. corporate accounts in 2025, triple the year before. The technology is becoming more accessible, more convincing, and more targeted. The incidents affecting organizations today are not edge cases. They are operational reality.
The 68 percent of executives who sense they are not prepared are not wrong. But sensing the gap and closing it are different things.
Deepfake readiness begins with one question: does your leadership team have a decision plan, or just a response plan?
If that question does not have a clear answer, the Crisis Decision Authority Diagnostic is designed to work through it.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations in Providence, Boston, Portsmouth, Portland, and Hartford, and across New England, nationally, and globally. mindthegapcyber.com