70% of Organisations Now Rank AI as Their Top Data Security Threat

AI-generated deepfakes and misinformation have moved from novelty to routine enterprise risk. The 2026 Thales Data Threat Report, based on research by S&P Global 451 Research, found that 70% of organisations now rank AI as their top data security threat, nearly 60% have experienced deepfake-driven incidents, and 48% report reputational damage from AI-generated misinformation or impersonation campaigns. The practical implication for corporate security and communications teams is that detection, response and legal preparedness now need to run in parallel, not in sequence.

Proactive Content Monitoring

Signal AI and comparable platforms give communications teams early warning of coordinated content campaigns before they reach crisis scale, tracking brand mentions, sentiment shifts and suspicious amplification patterns across digital channels. The goal is identifying what risk professionals call “white swan” events, visible, anticipatable threats, before the narrative hardens. Enterprises that lack this coverage tend to discover attacks after the content has already seeded mainstream coverage, at which point the correction cost rises sharply.

The detection challenge has grown alongside the generation capability. Deepfake video detectors developed by UC San Diego researchers have reached 98% accuracy in controlled conditions, but performance drops when content is compressed or generated by newer diffusion-era models, meaning lab benchmarks do not reliably predict real-world catch rates. Sensity AI and DuckDuckGoose offer enterprise video and audio analysis claiming similar accuracy thresholds, while Copyleaks reports over 99% accuracy on AI-generated text detection, including content blended with human writing. These figures are vendor-reported and real-world performance varies by content type and generation method.

Watermarking and Provenance Tools

EU AI Act Article 50, applicable from August 2, 2026, requires machine-readable marks on AI-generated synthetic content. Anthropic Google OpenAI and Mistral have signed a Code of Practice committing to compliance. Two technical mechanisms are in active deployment: Google’s SynthID, which embeds imperceptible digital watermarks in AI-generated images, and C2PA Content Credentials, which attach cryptographically signed metadata about content origin. For enterprises, these tools provide a defensible basis for distinguishing authentic material from AI-fabricated content in both internal investigations and legal proceedings. How consistently the watermarks survive third-party distribution and re-encoding is harder to verify from public material.

The provenance infrastructure also matters for document workflows where synthetic content may enter through supplier or partner channels rather than direct attack. Enterprises building content verification into procurement and vendor onboarding get an earlier intercept point than those treating it purely as a communications problem.

Incident Response Under Pressure

Detection buys time; response frameworks determine what enterprises do with it. AI agents can disseminate content across dozens of platforms within minutes, which means a response workflow that takes 48 hours to mobilise legal, communications and executive sign-off is functionally useless against the attack’s initial spread. Pre-approved communication templates, designated spokespersons and legal counsel on standby are the minimum viable structure. Courts are beginning to establish that liability may attach to parties who fail to act after being notified of false AI-generated content, which makes the speed and completeness of the documented response as legally significant as the response itself.

The practical sequence: assess scope and platform reach first; pursue removal or correction in parallel with external communications; keep stakeholder updates factual and timestamped. Enterprises that have rehearsed this flow, including tabletop exercises with legal and PR together, consistently move faster when an actual incident hits. Those that have not tend to lose the first critical hours to internal coordination rather than external response. The agent-specific failure modes driving these attacks are well-documented and can inform both the training scenarios and the response checklists.

Legal and Governance Frameworks

Courts are still setting precedent on AI-generated defamation, but the emerging litigation principle is that liability follows the party who caused or facilitated publication, including users who input prompts producing defamatory outputs and businesses that publish AI-generated material without adequate review. Section 230 of the Communications Decency Act, which typically shields platforms from user-generated content liability, is unlikely to extend to content the AI itself generates, a distinction that matters for any enterprise running customer-facing generative tools.

Internal governance needs to close this gap before litigation forces it. That means AI usage policies with explicit human approval requirements for AI-generated content, defined standards for data and vendor use, and regular bias audits. Terms of service and content review processes should already account for AI-generated risks, proactive legal structuring is cheaper than defending an unvetted output in court. The EU AI Act’s transparency requirements, alongside growing US state-level legislation, indicate that the regulatory floor is rising regardless of how the case law develops. Enterprises tracking EU AI Act compliance obligations will recognise the overlap between provenance requirements and defamation risk management.

Employee Training and Internal Protocols

Interactive training modules are specifically designed to help employees identify deepfakes, which addresses one of the more common internal failure points: staff forwarding or acting on synthetic content they believed was genuine.

Training programmes need to cover how AI agents function, what types of malicious output to recognise, and the corporate policies governing AI use, including data privacy requirements and the mandatory human review step before AI-generated content is published externally. Equally important: clear internal reporting channels so suspicious content or potential misuse reaches the right team quickly. Embedding these practices into onboarding and regular operations reduces both external attack dwell time and the risk of inadvertent internal missteps. Enterprises that have built AI literacy into routine workflows, rather than treating it as a one-off compliance exercise, tend to identify threats earlier and respond with fewer escalations.