Prediction 2

Authentication moves out of band as personal data no longer proves identity

The prediction

By 2027, an executive’s Social Security number, date of birth, addresses, relatives, and phone numbers will have to be treated as information an adversary already holds. Organizations will need to move away from authentication that relies on personal knowledge because stolen data can no longer serve as meaningful proof of identity.

AI expands that problem beyond what a person knows. Authentication based on what someone knows or possesses, or whether they sound or look like the expected person, will all become less reliable.

Agents can research an executive, reconstruct their relationships, reproduce their voice and appearance, create convincing pretexts, and repeat the attack across multiple channels until something works. Defenders, however, must avoid both approving an attack and disrupting the legitimate executive. Manually reviewing every interaction will not scale against automated impersonation.

Deepfake detection will remain useful as a signal, but it cannot become the trust boundary. “A generator needs to evade a classifier only once; a classifier must continue working across every new model, modality, and transformation,” says Swai Dhanoa, Head of AI, BlackCloak. “Watermarking faces a similar limitation because there is no universal standard and no way to require malicious or open-source models to participate.”

The result will be a move toward human-factor authentication: independently confirming that a trusted person intended a specific action. Out-of-band authentication will be one mechanism, but the larger shift will be from recognizing an identity to verifying intent. “Threat actors are going to use AI and deepfakes more at the help desk support level. We started to see that this year, pretending to be an executive or an assistant to get access to an account,” notes Dhanoa.

Signals behind the prediction

We regularly see attackers taking an executive’s identity and impersonating them, using SIM swapping to intercept the code that authorizes a password reset, and telephone number spoofing. “Once a threat actor has taken the persona of an executive and reset their passwords they can then go after people within their inner circle and beyond,” says Dhanoa.

In our 2025 research, 59% of security professionals rated deepfake detection as difficult or highly difficult, and 53% said technology that lets executives confirm the identity behind a message is highly important^{1, 2}, which is why we launched Impersonation Protection, an out-of-band method for executives to authenticate communications from their contacts, earlier this year.

External signals that influenced this prediction

NIST’s Digital Identity Guidelines state that knowledge-based authentication is not an acceptable authentication secret, and that knowing a Social Security number is not sufficient evidence of identity³.
Research on the Phantom Deal campaign describes attackers using real executive identities, corporate history, forged documents, WhatsApp, and personal email to manufacture a believable transaction, with no malware and no compromised corporate mailbox⁴.
CISA, the FBI, and international partners describe attackers impersonating employees and IT help desk staff to obtain credentials and defeat multifactor authentication⁵.

Why it is key for 2027

Removal of and monitoring personal data reduces exposure, but it cannot hide exposed information once it is in the hands of a threat actor. The objective therefore becomes twofold: to continually reduce data exposure, but also to limit what an attacker can still accomplish with it once they have it.

The new trust boundary will not be, “Does this person know the right information, possess the right device, or look and sound like the executive?” It will be, “Did the executive intend for this specific action to happen?”

Ponemon Institute, Digital Executive Protection Research Report 2025, including comparisons with the 2023 study. Sponsored by BlackCloak. blackcloak.io
Ponemon Institute, Faked to Perfection: The rise of deepfake threats against corporate executives, April 2025. Sponsored by BlackCloak. blackcloak.io
NIST, Digital Identity Guidelines, SP 800-63-4. pages.nist.gov
Gen Digital, Phantom Deal campaign research. www.gendigital.com
CISA, FBI, and international partners, joint advisory AA23-320A, updated 29 July 2025. www.cisa.gov