AI is reshaping the threat landscape faster than organizations are adapting. Attackers ranging from organized crime groups to state-backed actors are now able to compromise identity, distort reality, and undermine the decision-making structures upon which business continuity depends. Recent industry data indicates 62% of organizations experienced at least one deepfake-enabled social engineering attempt in the past year, illustrating how quickly this threat has become mainstream.
This acceleration compresses crisis timelines and erodes the familiar cues leaders rely on, particularly during high-pressure situations. For business continuity and risk professionals, the reality is that AI-driven threats can no longer be contained within the category of “IT risk.” They now present a broader governance concern capable of disrupting operations, distorting markets, increasing regulatory exposure, and damaging trust and reputation.
Despite this shift, cybersecurity, and AI governance often remain isolated within technology functions. Many organizations still treat AI resilience as a technical matter or “problem for IT” rather than a foundation of enterprise stability. Phishing and social engineering attempts have affected nearly every organization, yet fewer than half maintain a tested incident response plan. Even where such plans exist, many have not been updated to reflect the speed, precision, and psychological manipulation AI now enables. As a result, a widening gap has emerged between the velocity of threats and the readiness of organizations to confront them.
AI and the Manipulation of Reality
AI-generated misinformation requires governance frameworks rather than purely technical solutions. Forward-leaning organizations are beginning to expand the scope of their board’s risk or audit committee to include oversight of information integrity and executive impersonation threats. These committees help define decision rights, verification authority, and reporting expectations so misinformation incidents are treated with consistency and as enterprise level risks.
To operationalize this, some organizations are creating information risk command structures that activate during crises. A designated lead is responsible for authenticating executive communications and challenging fabricated narratives. This governance approach is often reinforced through enterprise-wide verification rules, clearly defined single sources of truth, mandatory out-of-band confirmation for high-risk instructions, and cultural norms that give employees permission to slow down and verify unusual directives. Continuous monitoring of narrative threats, supported by regular upward reporting, helps ensure synthetic-media risks remain visible at the board level.
Since executive identity itself has become an attack surface, strong governance increasingly includes digital-footprint controls, identity authentication measures, and monitoring for synthetic misuse of leadership likenesses. Boards are also strengthening oversight of AI tools used internally by requiring model audits and insisting on human review to prevent overreliance on automated judgments. Governance further extends to third parties through contractual requirements to address breach and impersonation reporting, as well as assessments of vendor readiness.
Where AI Resilience Fails: Not in Technology, but in Governance
Most organizations already possess adequate cybersecurity technology. The persistent weaknesses tend to involve authority structures, escalation routes, and verification procedures. Under pressure, employees frequently act on instinct, responding to familiar voices or urgent requests. AI impersonation amplifies these vulnerabilities by exploiting human trust and established communication habits.
Our experience in corporate and private wealth settings repeatedly reveals the same governance gaps. Unencrypted channels, outdated off-boarding processes, and inconsistent verification practices remain common exposures. Even sophisticated organizations struggle to enforce cyber hygiene across dispersed teams, subsidiaries, and third parties. Meanwhile, cultural factors such as traditions of discretion, decentralized communication, or reliance on long-tenured staff can further undermine resilience. These breakdowns are seldom technical in nature, but almost always reflect insufficient mandates governing verification authority, escalation rights, and policy enforcement.
At the management level, some firms are addressing this by establishing information risk steering groups that include cybersecurity, legal, communications, HR, and business continuity leaders. These groups preapprove verification protocols and rehearse rapid authentication procedures. Others are appointing a single executive responsible for information verification during crises, with the authority to validate or halt critical directives. Many organizations are now embedding out-of-band verification requirements, documented chains of authority, and regular misinformation drills within their broader risk management programs.
From Awareness to Enforceable Governance
Training remains important, but it cannot counter AI-enabled deception on its own. Organizations need governance architectures that clearly define, enforce, and routinely test decision making, escalation pathways, incident response, and verification processes. Cultural reinforcement is also essential, ensuring employees feel permitted to question unexpected instructions and escalate concerns even when circumstances seem urgent. Detection tools can support these processes, but they cannot replace them. Organizations that run regular cross-functional exercises consistently demonstrate quicker containment and recovery when incidents occur.
Why Boards Must Own AI Governance
Regulatory and insurance requirements are constantly evolving. Cyber-related insurance premiums are rising, and insurers increasingly require evidence of AI-specific safeguards, tested incident response plans, and well-documented verification controls. Regulators now expect organizations to demonstrate not only technical preparedness but also governance practices capable of sustaining legal scrutiny.
In this environment, AI resilience has become inseparable from enterprise risk, operational continuity, and reputational durability. Boards must therefore treat AI governance as a core responsibility. Integrating AI risk into the agendas of risk or audit committees, strengthening verification requirements for sensitive actions, and overseeing the governance of AI tools within the enterprise are becoming essential elements of responsible oversight. Boards must also ensure organizational structures support resilience through clear authority, empowered crisis decision making, and regular tests of these systems under realistic conditions.
The Imperative for Business Continuity and Risk Leaders
For business continuity and risk professionals, the path forward lies in reframing AI-driven threats as systemic risks which can disrupt essential business functions rather than as narrow technical issues. Boards engage most effectively when threats are expressed in terms of operational continuity, fiduciary exposure, regulatory liability, reputation, and enterprise valuation. Every one of these areas is now affected by AI-enabled manipulation across communications, treasury operations, payroll, supply chain processes, and other core functions.
This is fundamentally a governance challenge that requires governance solutions. Organizations whose boards and leadership teams adopt proactive oversight will be far better positioned to preserve stability as threats evolve. Those that fail to modernize their structures may find themselves facing crises in which neither information, nor identity, nor internal directives can be trusted.
For business continuity and risk leaders, this moment represents a critical opportunity. Their roles already span operational integrity, crisis decision making, and enterprise risk, which are precisely the domains targeted by AI-driven threats. They are uniquely positioned to guide their organizations by designing, testing, and embedding AI resilience practices that support both present needs and future challenges.
