In February 2024, an employee at the engineering firm Arup joined a video call with their CFO and several senior colleagues. The CFO instructed them to execute 15 wire transfers totaling $25.6 million. The employee complied. Every person on that call was fake — AI-generated deepfakes so convincing that a trained finance professional couldn't tell the difference.
No malware was deployed. No passwords were stolen. No firewall was breached. The attackers manufactured a reality, and the employee had no reasonable way to know it wasn't real. This is the new shape of corporate fraud, and it renders most of what companies currently rely on for security — including the AI tools they've rushed to adopt — dangerously inadequate.
We've spent months analyzing the Arup breach, the underlying technology that made it possible, and the architectural failures that left the company exposed. What we found isn't just a cybersecurity story. It's a fundamental challenge to how enterprises verify identity, authorize transactions, and trust what they see and hear. We published our full interactive analysis here.
No Hack Required: How the Attack Actually Worked
The most unsettling detail of the Arup breach is what didn't happen. Forensic investigators confirmed that Arup's digital infrastructure was never compromised. No unauthorized database access, no credential theft, no malware. The attackers didn't break in — they walked through the front door wearing someone else's face.
The operation unfolded in three stages.
First, months of reconnaissance. The attackers harvested publicly available video and audio of Arup executives — conference talks, YouTube appearances, corporate recordings. This footage trained AI models to replicate not just faces, but speech patterns, intonation, and micro-expressions. The result was what forensic experts call "high-fidelity synthetic twins."
Second, a carefully crafted email. A message appearing to come from the London-based CFO requested help with a confidential transaction. The target employee in Hong Kong was skeptical — an appropriate response to an unusual financial request.
Third, the video call that dissolved that skepticism. The employee was invited to a multi-participant video conference. Familiar faces appeared. Familiar voices spoke. The CFO repeated the request in what looked and sounded like a live, interactive meeting. The employee executed 15 transfers across five Hong Kong bank accounts. The fraud wasn't discovered until the employee followed up with the real CFO's office in London — and learned that no such meeting had ever taken place.
When a CFO's face and voice can be fabricated for the cost of a nice dinner, "I saw them on the call" is no longer proof of anything.
The Technology Has Outrun Our Defenses
What made the Arup attack possible wasn't some classified military technology. It was the convergence of two AI techniques that have become dramatically cheaper and more accessible: face synthesis and video injection.
The faces on the call were generated using Generative Adversarial Networks, or GANs — a system where two AI models compete against each other. One generates fake faces; the other tries to detect fakes. Through millions of rounds, the generator learns to produce faces that fool even its own detector. Paired with diffusion models (which excel at realistic lighting and texture), the result is video that doesn't flicker, distort, or glitch — the telltale signs most people associate with "bad deepfakes."
But the real escalation is in how the fake video was delivered. The attackers didn't hold a screen up to a camera, which security systems can sometimes catch. They used video injection — feeding the synthetic video directly into the conferencing software's data stream. Zoom, Teams, or whatever platform was used simply treated the AI-generated feed as if it were coming from a real webcam. No physical camera was involved at all.
This isn't a fringe technique. Research shows injection attacks targeting identity verification systems increased by 255% in 2023, while face-swap attacks rose by 704%. Criminals are abandoning crude physical spoofs in favor of digital manipulation that bypasses the entire camera layer.
The attackers didn't defeat Arup's security. They made it irrelevant by operating in a layer the security systems couldn't see.
Why Most Enterprise AI Makes This Problem Worse
In the rush to adopt generative AI, most companies have built what we call "wrapper" architectures — thin software layers that connect internal processes to public AI services like GPT-4 or Claude through their APIs. For drafting emails or summarizing documents, this works fine. For anything involving security, financial authorization, or sensitive data, it's a liability.
The problem is threefold.
Sensitive data leaves your building. In a wrapper setup, your financial spreadsheets, internal memos, and executive communications travel to a third-party cloud for processing. Even with contractual promises, that data now exists in an environment you don't control, subject to foreign data laws and opaque sub-processor chains.
The AI guesses instead of knowing. Large language models are prediction engines — they generate the most statistically likely next word, not the objectively correct answer. When an AI agent reports a price, interprets a policy, or authorizes an action, it's predicting what sounds right, not retrieving a verified fact from your systems. In a high-stakes financial context, this "reliability gap" is the difference between a correct authorization and a costly hallucination.
The AI can be manipulated. Wrappers are vulnerable to prompt injection — carefully crafted inputs that trick the model into ignoring its safety rules. If an attacker can manipulate the AI layer, they've found a new path into your operations that your traditional security tools don't monitor.
None of this would have prevented the Arup attack directly. But it illustrates a deeper truth: most companies are simultaneously more dependent on AI and less in control of it than they realize.
What "Sovereign AI" Actually Means (and Why It Matters Now)
We use the term Deep AI to describe an architectural approach that's fundamentally different from the wrapper model. The core principle is simple: your AI, your data, your infrastructure. No exceptions.
This means deploying full AI inference capabilities — the actual models and the systems that run them — inside your own secure environment. Not a vendor's cloud. Not a shared API. Your own virtual private cloud or on-premises servers, where sensitive data never crosses your perimeter.
But infrastructure ownership alone isn't enough. The AI itself needs architectural guardrails.
We advocate for what we call a neuro-symbolic approach — essentially, sandwiching the creative language model between two layers of rigid, rule-based logic. The bottom layer sanitizes inputs before they reach the model, blocking injection attacks. The top layer intercepts the model's output and executes it through verified, deterministic functions — querying a real database for a real number instead of letting the model guess.
When this system reports that a transaction is authorized, it's because it checked the authorization database. When it quotes a price, it pulled that price from the ERP system. The language model handles understanding and communication; the logic layers handle truth.
The retrieval system is equally important. Unlike generic AI setups where the model can access anything it can find, a sovereign architecture enforces role-based access at the AI layer. If an employee doesn't have permission to view a document in SharePoint, the AI won't retrieve that document to answer their question — even if it would make the answer more complete.
For a detailed technical breakdown of this architecture, including the neuro-symbolic design and private deployment methodology, see our full technical deep-dive.
The New Authentication: Biology, Behavior, and Cryptographic Proof
The Arup breach proved that faces and voices are no longer reliable identity signals. So what is?
The answer is layering three types of verification that current deepfake technology cannot simultaneously fake.
Physiological signals that AI can't replicate. Your face subtly changes color with each heartbeat — invisible to the naked eye, but detectable by advanced cameras. Technologies like Intel's FakeCatcher analyze these micro-signals in real time. In synthetic video, these cardiovascular signatures are absent or temporally inconsistent. A deepfake can look like you, but it doesn't have your pulse.
Behavioral patterns that are neurobiologically unique. How you type — the speed, rhythm, and pressure — creates a signature as distinctive as a fingerprint. How you move a mouse, how you swipe on a screen, even how you navigate between applications. These patterns are extraordinarily difficult to forge because they're rooted in your neuromuscular system, not your appearance. If the "CFO" on a call starts requesting unusual transfers while their typing cadence doesn't match their historical profile, the system flags it automatically.
Cryptographic proof of authenticity. Rather than just detecting fakes, the industry is moving toward verifying originals. The C2PA standard — backed by Adobe, Microsoft, and others — embeds tamper-evident metadata at the moment of video capture: what device recorded it, when, and where. A video feed without these credentials should be treated with the same suspicion as unsigned software.
We need to stop asking "Is this fake?" and start requiring proof that it's real.
What About Smaller Companies Without Big Security Budgets?
The Arup breach targeted a multinational firm with significant resources. But the underlying technology is cheap and getting cheaper. The question of "can this happen to us?" has a straightforward answer: yes, and the barrier to entry for attackers drops every month.
The good news is that the most impactful defenses aren't the most expensive ones. Mandatory out-of-band verification — confirming any high-value transaction through a separate channel like a direct phone call to a pre-verified number — costs nothing to implement and would have stopped the Arup attack entirely. Dual authorization requirements, where a second approver who wasn't on the original call must sign off, add friction but eliminate single points of failure.
The cultural shift matters as much as the technology. Organizations need to move from a "comply immediately when leadership asks" culture to one of empowered skepticism — where employees are rewarded for questioning unusual requests, even from apparent senior leaders. Training should include live deepfake simulations, not just static phishing emails, so staff understand viscerally what the technology can do.
Does This Create Legal Liability for Executives?
Increasingly, yes. CIOs and CTOs face growing personal exposure under frameworks like the EU AI Act and California's CCPA. Courts evaluating wire transfer fraud often apply the "Impostor Rule" — losses fall on the party best positioned to have prevented the fraud. In Arup's case, the absence of multi-channel verification for high-value transactions could be viewed as the primary failure, regardless of how convincing the deepfake was.
Organizations should align with emerging standards now, before an incident forces the issue:
ISO/IEC 30107-3 for presentation attack detection — the international benchmark for biometric spoofing resistance
NIST AI Risk Management Framework for structured AI risk identification and mitigation
CEN/TS 18099 — the first dedicated standard for detecting video injection attacks
Seeing Is No Longer Believing
The Arup heist marks the end of an era. For decades, a video call was the ultimate verification — if you could see and hear someone, you could trust they were who they claimed to be. That assumption is now a vulnerability.
The path forward requires defending three layers simultaneously. People need training that goes beyond awareness posters — they need to experience deepfakes firsthand in controlled simulations. Processes need mandatory out-of-band verification for any significant financial action, with no exceptions for apparent seniority. Technology needs to move from wrapper-based AI that sends your data elsewhere to sovereign architectures where your intelligence stays inside your walls, governed by logic, not just probability.
The $25.6 million Arup lost is a rounding error compared to what's coming if enterprises don't adapt. The tools that created those synthetic executives are better today than they were in February 2024, and they'll be better still next quarter.
If your organization is grappling with how to verify identity and intent in a world where both can be manufactured, we'd welcome the conversation. This is a problem that gets solved through shared urgency, not in isolation.