AI Deepfakes Create "Synthetic Insiders"

North Korean actors have been implicated in a sophisticated hacking campaign, using AI-generated deepfakes to impersonate remote employees and infiltrate US companies. Stolen identities of over 80 American citizens were employed across more than 100 businesses, illicitly generating millions for the Democratic People's Republic of Korea. This scheme highlights the escalating threat of "synthetic insiders," individuals who leverage convincing AI-driven deepfake images, video, and audio to gain fraudulent employment.

The case underscores the broader issue of insider threats, which range from unintentional data leaks to deliberate theft driven by financial motives or grudges. A 2026 Verizon analysis indicated that 12% of global incidents involved internal actors. The proliferation of low-cost AI tools facilitates these targeted attacks, as "synthetic insiders" know where critical data resides. Companies are responding by integrating HR, security, legal, and IT functions more tightly, especially for high-risk remote roles.

Cybersecurity experts recommend rigorous identity verification and deepfake detection tools during the application process. Low-tech methods, such as simple physical actions, also remain effective. Post-hiring, vigilance against "laptop farms" and behavioral analytics are crucial. However, accidental human error, such as using unsanctioned AI tools or misdirected emails, accounts for a significant portion of breaches. The rise of "shadow AI" further complicates security, as employees may inadvertently share sensitive data with unapproved models.

Protecting sensitive data is a growing concern, evidenced by the data loss prevention market's expansion from $33 billion in 2025 to nearly $43 billion this year. While advanced analytics can flag suspicious employee behavior, striking a balance is key. Overly intrusive monitoring can erode trust and encourage workarounds, while insufficient controls leave organizations vulnerable. Future risks include AI agents themselves potentially misusing data or going rogue, necessitating robust identity management for both human and AI entities.