The Deepfake Dilemma: How GenAI Is Rewriting Cybersecurity

Deepfake videos are all kinds of hilarious. Ever wanted to see Tom Cruise speak in perfect Chinese with a Beijing accent? Deepfake! Ever wondered what your favorite movie would look like if it cast fan-favorite actors? Deepfake! But, beyond entertainment value, deepfake videos and generative AI technology come with a dark side. They have the power to amuse—but they also have the power to trick people into handing over sensitive financial information willingly. If you thought the old-school phishing emails from a “Nigerian prince” were bad, deepfakes make them look like child’s play.

The Rise of Generative AI and Deepfake Attacks

Unfortunately, this isn’t just speculation. According to the fifth edition of HYPR’s State of Passwordless Identity Assurance Report, nearly 40% of organizations reported a generative AI-related security incident in the past year, and 95% were hit with some kind of deepfake attack.

Yes, you read that right—ninety-five percent. If that infographic above doesn’t make you want to pick up your phone and call an emergency meeting with your IT admins, we don’t know what will.

We’re talking about fake ID photos, AI-powered job candidates with borrowed faces, and even real-time video impersonations during meetings. You thought it was embarrassing telling your friends you got catfished on Tinder? Try explaining to the police and your company’s CEO that you were catfished by a deepfake video pretending to be your boss asking you to make an urgent transfer of $1 million into an unknown bank account located in another country. See how well that flies!

In the past, hackers would breach systems using brute force attacks. This basically involves hackers using a list of commonly-used passwords as well as passwords from past breaches to try and guess their way into your systems. This is why, in the past, it was stressed upon users to choose a strong password. One that isn’t your birth date.

But now with deepfake? A carefully crafted video is all it takes for employees to hand over information with a smile and a short “Let me know if you need anything else!” sign-off at the end of their emails.

The Cost of Doing (Deepfake) Business

And these breaches don’t come cheap.

Last year alone, 49% of organizations were breached, with 87% of those breaches tied to identity vulnerabilities—things like stolen passwords, MFA bypasses, and credential misuse. And it’s costing companies big time. On average? Each incident cost them $2.5 million. That’s enough to buy a mansion or fund a small startup!

The fallout doesn’t stop at the bank account either. These attacks are taking down careers and crushing company morale. HYPR’s report estimates that 33% of affected companies suffered reputational damage, 21% got slapped with legal trouble, and in some cases, executives were demoted and frontline staff laid off to clean up the mess.

So how are these attacks working? Simple: We’re still relying on digital defenses from the dial-up era.

HYPR’s report claims that a whopping 47% of breaches came from credential misuse. It also shows another 35% of breaches comes from MFA bypass. You know that little OTP security feature? Yeah, not so effective anymore.

The worst part is that 40% of organizations are still using passwords as its primary security feature. Remember, we are now living in 2025. This is the age of AI where readily-available generative AI tools can be downloaded from your favorite app store and can literally take your photo and insert it into a semi-believable deepfake video in mere seconds.

The Future Doesn’t Have A Password

So, what’s the fix? Enter the FIDO passkey—the superhero of modern authentication (minus the tights, cape, and red underwear).

FIDO, short for Fast IDentity Online, passkeys are a phishing-resistant way to log in without using passwords, codes, or secret questions about your favorite teacher from high school. Instead of typing in something that could be stolen or guessed (like a password), you prove who you are by using something you already own—like a smartphone or tablet with a fingerprint or facial recognition system.

How it works is your device stores a private key that never leaves it. When you log in, the website or app checks that key against a public key, kind of like a secret handshake you make when you want to enter that cool, underground speakeasy bar that everyone’s raving about on TikTok.

That means there’s nothing to steal, nothing to phish, and nothing for hackers to guess.

FIDO passkeys are fast, secure, and basically unhackable unless someone physically has your device and your face or finger. That’s why companies are rushing to adopt them, which the HYPR report says they’ll be the leading form of authentication by 2027.

According to Bojan Simic, the CEO of HYPR, “We’re not just replacing passwords. We’re fundamentally shifting how we manage and verify identities.”

Conclusion: Deepfake is Here to Stay

The unfortunate truth is that deepfake and generative AI is here to stay. There are so many benefits that can come from these tools, but as HYPR’s report suggests, we must also be vigilant because these tools can just as easily become weapons.

Companies, IT admins, and users have to educate themselves on these new forms of attack and take proactive measures when upgrading their security systems. It might seem overwhelming, especially if you grew up in the golden age of passwords. However, unless you want to wake up and find your bank account drained of your life savings, spending a few extra hours or days reviewing your security protocols seems like a small ask.

As Garrett Bekker, Principal Research Analyst at S&P Global Market Intelligence 451 Research puts it, “Organizations must now prioritize the deployment of phishing-resistant authentication such as FIDO passkeys and other modern identity verification tools, not as a future aspiration, but as a core component of their immediate risk mitigation strategy.”

Or, if you want to start simple, maybe it’s time to change your password from “123456” to something that’s a little harder to guess, you know, at least make the hackers work for your money.