Show Notes
Are you confident you could spot a deepfake in your next meeting, or could someone be using your identity without you knowing? Welcome back to Razorwire, the cybersecurity podcast where we explore the challenges professionals face at the cutting edge of threat intelligence. In this episode, I sit down with Alexandra Jorissen, a specialist in deepfake detection and digital identity safeguards. We discuss the explosive rise of deepfake technology, where it's already being used and what it means for personal and professional security. Summary It’s no longer science fiction: deepfakes have become both a tool for petty fraud and a devastating weapon for sophisticated cybercriminals. Together, Alex and I discuss how rapidly these impersonations have improved, from laughable scams to well-orchestrated attacks inside global organisations. We get into how deepfakes are now being used for document fraud, insurance scams and internal expense fraud, and why most people still think they'd be able to spot one. Alex shares inside knowledge from her work with IdentifAI, reveals how detection technology is developing, and offers practical advice for anyone safeguarding digital identities, documents, and core business processes. Key Talking Points & Reasons to Listen Inside Real-Life Deepfake Attacks Hear how a single convincing deepfake Teams meeting led to a $25 million loss at engineering firm Arup, why even well-trained employees followed standard processes and still got fooled and what this tells us about how far social engineering has come. How Deepfakes Bypass Everyday Security Find out how deepfakes are being used far beyond fake videos, from altered salary slips and AI-generated taxi receipts to fraudulent insurance claims, faked passports that pass KYC checks and criminals impersonating executives in remote meetings. Learn why one company discovered its internal expense fraud was three times worse than expected. Detection, Zero Trust and Practical Defence Learn how IdentifAI's forensic detection analyses images pixel by pixel in nanoseconds, why a zero trust mindset needs to extend to identity verification in everyday business and what simple, practical steps like secret questions and duress codes can do to protect against impersonation right now.
This is a must-listen for anyone who wants to understand the new deepfake threat landscape, and pick up the actionable intelligence to defend against it. Verifying Identities in Online Meetings: "A lot of people I speak to, they seem to think deepfakes aren't there yet. Like they would still be able to spot them. And that's a very false presumption." Alex Jorissen
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics: The Evolution of Deepfakes See how deepfake technology has gone from laughable early efforts like the Will Smith spaghetti video to highly convincing fakes that even experienced professionals struggle to detect. Social Engineering and Deepfakes Learn how deepfakes are supercharging traditional social engineering tactics, making phishing and impersonation attacks far harder to spot than they used to be. Real-World Deepfake Scams Hear about actual cases where organisations have been deceived, including the Arup finance manager who transferred $25 million after a fake Teams call and companies that accidentally hired North Korean engineers using deepfaked identities. Abuse of Deepfakes for Fraud and Blackmail Find out how criminals are using AI to create compromising content of real people, using faked media to ransom victims or threaten reputational damage. Document and Identity Fraud Discover how deepfakes now extend to digital documents and IDs, with faked passports passing standard KYC checks and altered salary slips being used to secure larger loans. Breach of Age and Access Controls Learn how people, including minors, are using deepfaked images and identities to get around age
More from Razorwire Cyber Security & InfoSec Insights
Awards you have to pay to win, events you have to pay to attend and conferences that expect speakers to work for free. When did recognition and expertise in cybersecurity become something you have to buy? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by security consultant and regular community speaker James Bore and Gary Hibberd, co-founder of Consultants Like Us and the Real Cyber Awards and Conference. Pay to play takes many forms in cybersecurity, from awards that come with entry fees and expensive tickets to events charging vendors thousands for access to decision makers. At the same time, large commercial conferences can expect experienced speakers to give up days of preparation, travel at their own expense and appear on stage in return for little more than exposure. Jim, James and Gary look at where legitimate commercial arrangements end and questionable practices begin. They discuss what gives an award credibility, when paying for access to an event can be worthwhile and why the way cybersecurity treats its speakers could ultimately affect the quality of the events themselves. Three key talking points When recognition comes with a price tag Not every paid award works the same way. From outright offers to buy recognition to free entries followed by expensive ceremony tickets, we look at the different forms pay to play can take and why credibility depends on what happens behind the award. Should cybersecurity speakers be paid? Community events and large commercial conferences operate very differently. We discuss when speaking for free makes sense and why expectations should change when an event is making significant money from exhibitors and attendees. Good speaking takes work A short conference talk can take days of preparation. James and Gary get into the work behind becoming a strong speaker, why experience and preparation matter and what happens when events prioritise sponsored slots over good content. If you're deciding which awards and events deserve your time, or building a reputation as a cybersecurity speaker, this conversation is for you.
If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode I'm joined by James Millington, Healthcare Field CTO for EMEA at IGEL, with more than 25 years' experience across virtual desktops, endpoint security and healthcare technology. The way we use endpoints has changed repeatedly. Computing moved from centralised mainframes to PCs, back towards virtual desktops and then into SaaS and cloud services. Hybrid working accelerated that shift again, while rising hardware costs, Windows upgrades and increasingly distributed workforces are forcing organisations to reconsider what they actually need sitting on a user's device. Jim and James look at why the endpoint may be due another rethink. They discuss the security and cost implications of maintaining traditional operating systems, how immutable endpoints change the approach to endpoint protection and what happens as AI creates another generation of applications and risks for security teams to control. Three key talking points: Do we still need Windows at the endpoint? As applications move into SaaS, VDI and the cloud, the role of the endpoint is changing. We look at whether organisations still need a full traditional operating system on every device and what alternatives become possible when workloads run somewhere else. Moving from detection to prevention Endpoint security has traditionally relied heavily on detecting problems and responding to them. Discover how reducing what can run or change on an endpoint alters that model and removes attack surfaces before they need to be monitored. The endpoint problem AI could make worse Shadow AI gives employees another way to introduce software and move information beyond organisational controls. We discuss how controlling what can execute locally could become increasingly important as AI workloads start moving from centralised services onto endpoints.
Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions. Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value. We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again. Three key talking points: When a conference stops being worth it A ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors. Why smaller events feel different Community and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate. People don't go to events to be sold to Expensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.
What does it actually look like to break into InfoSec from the outside, with no technical background, no industry contacts and no idea what half the acronyms mean? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this interview episode, I'm joined by Irina Sordiya, a GRC and compliance professional based in Montreal who came into information security from a finance background. Not everyone who works in information security started out in IT. Irina's route in began at a career fair where she stumbled into a fintech startup looking for someone who could translate financial regulation into language a dev team could understand. From there she moved into auditing at KPMG and eventually crossed to the other side, leading security posture and compliance in-house. This is a conversation for anyone considering a career in InfoSec or in the early stages of one. Irina talks openly about feeling like an outsider, not understanding the acronyms and slowly realising that GRC isn't about technical knowledge, it's about understanding risk, building trust and communicating with people. She and Jim also get into the growing problem of grifters in GRC, where Canadian regulation is heading and why the InfoSec community is one of the most welcoming places to build a career. Three key talking points: You don't need a technical background Irina came from a finance degree with no IT experience and a job interview where she was asked if she knew what an auditor does. She got the job. This episode is proof that soft skills, empathy and a risk mindset can take you further than most people expect. G is for grifter in GRC As regulatory pressure has increased, so has the number of people selling shortcuts. Overpriced courses, AI-generated templates, agents claiming to replace the CISO. Irina and Jim discuss why this preys on people trying to break in and why there's no substitute for doing the work. The risk mindset as a North Star The best advice Irina received early on was to develop a risk mindset. It's what helps you step back from hundred-page policies and ask what you're actually trying to protect, and why it matters more than technical knowledge for anyone in GRC.
Social engineering has been around since humans started talking to each other. The psychology hasn't changed, but AI has made the execution almost unrecognisable. Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Bec McKeown, a chartered psychologist specialising in human performance under pressure. Social engineering isn't a technology problem, it's a human one that cybersecurity has inherited. The psychology behind it hasn't changed since Cleopatra was using it to outmanoeuvre empires, but AI has transformed the speed, scale and sophistication of every stage, from automated reconnaissance that builds a complete profile in 30 minutes to real-time voice cloning that references your actual projects and travel schedule. Bec and Richard bring two very different perspectives to the same problem. Bec explains how attackers engineer the conditions in which people make decisions rather than just crafting a convincing message, and why "people are the weakest link" misses the point. Richard shares what he's seeing as a practising CISO, from family members being targeted through gaming platforms to why measuring phishing click rates gives organisations a dangerous false sense of security. Three key talking points: They're not hacking people, they're shaping decisions: Social engineering works because attackers engineer the conditions under which decisions get made, not because people are careless. Bec explains why most security awareness training is solving the wrong problem by focusing on the message rather than the environment in which people are operating. AI has turned social engineering into an automated pipeline: What used to take weeks of manual reconnaissance now takes 30 minutes. AI-powered OSINT can build a complete profile of a target and generate a tailored attack that references their projects, travel and communication style. Combined with real-time voice cloning, these layered attacks are becoming almost impossible to distinguish from a legitimate request. Your family is now part of the attack surface: If the executive is too well protected, attackers go to the people around them. Children on gaming platforms are being cultivated to unknowingly share information about their parents' work and routines, and a compromised family device on a shared home network becomes a route into the corporate environment.