By Sean Martin, Co-Founder of ITSPmagazine

A BlackCloak member can now send an Impersonation Protection request to anyone within their inner circle. The personal lawyer. The private banker. Childcare. The person who walks the dogs. Matt Covington, Senior Vice President of Product at BlackCloak, calls that the news of the week, and it changes who counts as confirmable. Until now the question of authenticity stopped at the edge of the platform. The circle of trust extends it to the people an executive actually hears from on a Tuesday afternoon.

Why build authentication into the phone instead of into the message?

Because BlackCloak already has a point of presence on the executive’s device. Covington says the feature exists because CISOs kept asking the same question: can you help us manage this influx of deepfake media, whether it arrives by email, video, or voicemail. His team declined the detection route.

Rather than sitting in line with every communication to judge whether a piece of video or audio is fake, BlackCloak gives people a way to establish the authenticity of the message and the message’s sender. The check runs on a channel the suspect message does not control. The question shifts from what is this content to who is this person.

What does a validation request look like in practice?

Covington walks through a Zoom call where someone joins under the name Tracey Moon, camera off, voice slightly wrong. Because the two are already connected, he opens the BlackCloak app, creates a new request, finds Tracey Moon in his address book, selects video as the medium, adds a personalized message to set context, and submits. Biometrics confirm he owns the device. The request lands on Tracey Moon’s phone. The response comes back as the message being legitimate, confirmed by device-level biometrics and her location in Las Vegas, Nevada. The app keeps an audit trail of everyone he has corresponded with this way.

Extend that to the dog walker and the operational picture changes. Covington describes being on vacation and receiving a message claiming to be the dog walker, asking for $5,000 for an emergency vet bill. He confirms that scenario is a real thing that has happened. With the invitation model, the dog walker is already set up on the app, proactively, before the message arrives. Authentication becomes a step someone can take in the moment of decision rather than a forensic exercise afterward.

The finance team escalation and the personal wire request are the same attack wearing different clothes. Both ask a human to act quickly on the word of someone familiar. The question worth putting to any security program is how far its identity assurance actually reaches, and whether it covers the relationships that sit outside the corporate directory.

Watch the full Brand Spotlight to see the request sent and answered on camera, and connect with Matt Covington and Tracey Moon on LinkedIn to continue the conversation.