How CFOs Mitigate the $25M Deepfake Risk | Human Firewall Protocols for 2026 with Michele Novack

0:00 The moment digital trust broke for everybody. It's. The rules fundamentally change when we move from static, a fake e-mail to real time synthesis, a live call, a live video call. Think about that. The death of trust happens the moment we can no longer rely on your eyes and ears to verify identity.

0:19 That is the problem when seeing is no longer believing, the social contract of digital communication is essentially voided. Think about that. I will tell you what they're going to learn if you come is you're going to learn some key protocols that you can do to protect your business. Why? We're going to talk a lot about the human firewall.

0:37 You're going to walk away with a couple of PDFs that will help your business structure and build those protocols within your environment, which I think is key, right? Before we dive back into today's conversation, I want to share something important. This episode includes a pay partnership with Better Help, a platform designed to make starting therapy easier. I know from my own journey as a leader and entrepreneur that life can sometimes feel overwhelming. There are seasons, beer, uncertainty, and pressure build up, and you need a safe space to process it all that superior therapy comes in.

1:04 Therapy isn't only for people facing clinical challenges. It's a space to reflect, grow, and find better ways to manage stress, relationships, and personal goals. It takes courage to seek help, but it's also one of the smartest investments you can make in your mental and emotional well-being. That's why I'm proud to highlight Better Help. With Better Help, you simply feel out a short questionnaire and get matched with a credential therapist in just a couple of days.

1:25 If the first match doesn't feel like the right fit, you can easily switch the therapist at no extra cost until you find someone who truly connects with you. Inside the platform, you'll also find tools like journaling and group sessions on different topics that can support your growth. And with over 7000 reviews and a 4.5 trustpathy reason, Better Help is a platform you can rely on. So if you feel like you'd benefit from talking to a therapist.

1:44 Visit Betterhub. Dot com forward slash kingdames that's betterhub.com/kingdames to get 10% off your first month of therapy. Once again, this is a paid partnership with better Help and I encourage you to take that first step. If you've been thinking about it, sometimes the best investment you can make these in your. Welcome to The Kingdom's podcast, where we share the stories of extraordinary people and dissect hot, relevant topics that shape our world.

2:13 From visionary leaders to trailblazing creatives, we uncover the mindset, strategy, and grit behind greatness. Whether it's business, culture, or personal growth, we ask the real questions. This isn't just conversation, it's transformation. The Kingdom's podcast, Your Next Breakthrough, starts here. Licensing reimagined.

2:36 We are live. Ladies and gentlemen, you once again welcome to the Kingdom's podcast. And I've got with me a triple VIP coming in for the second time, Meg Walker fighting out of the United States of America. Michelle, the cyber security expert. Novak, how are you, Michelle? I am fantastic today. What an introduction. Wow, that's fantastic.

3:06 Day. Wow. Yeah, we've given you the combat sport introduction and of course let's give you the corporate style introduction. So ladies and gentlemen, today's conversation is not about theory, it's about reality. In the last 12 months alone, organizations have lost 10s of millions of dollars to AI driven deep fake attacks that bypassed traditional security food, experienced executives, and collapsed trust in real time.

3:36 Our guest today has been warning leaders about this shift long before it made the headlines. Michelle Novak is a cybersecurity author, authority and executive advisor. Who works at the intersection of technology, human behavior, and organizational risk. Her work focuses on how AI, deep fakes, and synthetic identity threats are redefining fraud, appliance and leadership making a decision making.

4:05 So what sets Michelle apart is this. She does not just talk about tools. She focuses on protocols, culture, and human systems. The elements that feel fast when technology outpaces policy. She has advised leaders on how deepfake fraud actually works in the real world, why verify with a call is no longer enough, and how organizations can build a human firewall that protects assets, identity and trust in an era we're seeing and hearing are no longer believing. Today, Michelle is here to break down why AI powered deepfakes represents the number one corporate threat of 2026 and what leaders must do now, not later to stay ahead. Michelle Novak, you once again welcome. It's a pleasure to have you with

4:57 us again a day. Wow, your work is actually very, very important. Or as an introduction. You, you deserve it because your body of work is a mouthful. And I can say it's also a globe fool because this is a global threat we are dealing with here. You've actually spent years at the intersection of cybersecurity, leadership and risk. So from what you are seeing globally right now, why are AI deepfakes no longer a future concern but a present day executive threat?

5:32 Yeah, that's a great question, right? We've moved from CGI era to the real time era. That's what I like. Previously, deepfakes were labor intensive and easy to spot. Today, the demonetization of compute power means a teenager can clone ACVCEO's voice for $10. That's the truth. For executives, this is a present day threat because your identity is now your most vulnerable.

5:59 Untatched API can be you. They don't need to hack your firewall, they just need to ask for the keys. So think about that. Wow, thinking about that your upcoming or forthcoming webinar, right is going to address a lot of these issues. But when I saw that webinar and I saw the details that are going to be discussed on the webinar, something's chewed out for me and it is the now infamous $25 million Zoom call incident. Why was this case so dangerous?

6:36 Like, not just because of the money lost, but because of what it revealed about human behavior and verification processes? Oh, why is this a serious? Issue. Why? Yeah. You know, let me say this right, The Hong Kong Zoom incident was terrifying. Terrifying because the employee did have doubts, but those doubts were overridden by the presence of his colleagues on the screen.

7:07 What he didn't know is that every colleague on that screen was a deep fake. It revealed that social engineering scales perfectly with AI, and that's what these hackers are using today. It wasn't a failure of tech, it was a hack of human need for social validation. And that's what you got to think about, right?

7:30 It proved that if the boss is on the screen, humans are wired to obey, not to audit and question. And that's the why, right? The human aspect of this. And that's what these hackers are, you know, dependent on. They know the psychology and they're building these tools to do it. You know, you talk fondly about why verify with a call no longer works. So many firms still teach staff to verify with a call. What is that advice that you will give right now? And of course, why is the old advice not outdated and in some cases actively dangerous?

8:11 So there's two parts to that, right? The advice is now a liability. And I'll tell you why and why I think that, you know, if you can clone your voice with a 32nd clip from a YouTube keynote, a phone call is just another playground for those attackers to work. And that's what they're doing, right?

8:26 There's a couple of different techniques that they're doing out there that we have to be very diligent and be aware of. And that's my message to everybody today. Know what's out there, know the tools they're using and understand that telling staff to just call gives them a false sense of security, right? You need to go deeper than that.

8:44 And that's what I my webinar, the things that you can actually do that will help you go a little bit deeper than just saying, hey, is this real? In the deep fake era, an unverified voice is just a sophisticated script and these tools that they're using sound just like, let me on this call right now, right? That's how scary it is.

9:05 Absolutely. Now intelligent people are off. Sorry about that. Yeah. And it is scary. You know it is. You were talking about intelligent people. What is it with intelligent people? You know deep fakes can bypass smart people. That's what I like to say, right? You and I are both very intelligent, but intelligent people often the easiest to manipulate because they rely on the contextual logic. Attackers use linguistic mirroring and high pressure scenarios that hijack, right, the prefrontal cortex. Your brain is a human computer.

9:38 I talk about this through all my books and everything else and how we process information, right? And that's all They figured out a way how to psychology psychologically, sorry, hack that right by using these tools, high performers are also fixers. They want to be helpful and efficient. AI exploits that right.

9:59 They exploit the bias towards the action, turning an executive productivity against them. And that's just the truth of the matter. Wow. So I've actually had a couple of neuroscientists on on the podcaster and particularly we've had a neuroscientist from Stafford University. And I think what most of them agree about is the fact that the prefrontal cortex is like the CEO of the brain, right? So with smart people being tricked into making schoolboy errors, it's really alarming.

10:35 And you know, we have this rise of the euthantic scams. So your briefing actually talks about euthantic scams, AI systems that can negotiate, argue, build trust autonomously. So why is this a fundamentally new category of threats that most boards are not prepared for? You know, most scams right out there are one and done.

10:56 And I'll say that a genic scams are different. They're AI systems with a goal capable of navigating a conversation. There's the difference, right? They can be trained, and again with the neural aspect of it, they can pivot if you ask a difficult question or play the long game over weeks to build rapport.

11:22 Boards aren't ready for a threat that can argue, negotiate, and wait for the right moment to strike. They're not prepared for it, right? So they need to invest in the deep training, the human element of it and understanding how these agenic AIS are targeting people and what they're using to target.

11:44 I think that's the key. Speaking of investing, right, a lot of businesses should not really see that value in investing in cybersecurity, but I think they they get to pay for it very, very heavily, right? So you argue that software will always be one step behind AI. Why does the future of defense shift from tools to human protocols?

12:07 You know, cybersecurity to human security, let's say that, right? Software is reactive, it hunts for known signatures, right? But AI generates 0 day content every second. You know, we can't, we cannot out code the speed of synthetic reality. And I think that's the key there, you know, when you're taking a look at defense, right?

12:30 Everything is moving at a rapid pace. And we talked about software versus a genetic AI. We're also talking about quantum computing that's coming. It's going to be massive over the next couple of years. What these tools can do site the cybersecurity world right now, right? Every agency, every country a driving to build proactive instead of reactive ways to protect, right? Therefore, the defense must shift to human. Protocols have to shift.

13:07 We need to focus on how humans make decisions under pressure rather than just hoping the spam filter catches the bee or the phishing e-mail. You know what I'm saying? Like you have to incorporate your people and train them fundamentally so they are aware. Especially in larger corporations, it's so easy. You know, we talk about whaling.

13:28 There's so many different type of scams out there and things that can be done. But whaling is one of the biggest, right? You know, when you go back to the Hong Kong event, there's not only that, there's tons of them I just had, and I'll just share with you, right? Just have one of my clients have what they call a BEC attack, right? Where their e-mail was intercepted, sent an invoice to redirect to pay an invoice to a hacker. We got into the system fourty $1000. Think about that now if you would train those employees and they used right, they verified they verified through through e-mail.

14:03 Is this the right amount this that everything was a green light. They still got hacked. So I would say the human element is more important than anything else right now, especially especially. OK, so are you able to walk us through the human firewall concept and why is it more resilient than traditional cybersecurity controls in a world of real time deepfakes?

14:27 Yeah. You know, the human firewall framework is kind of the way you need to go with AI and the attacks that are happening out there today, right? Traditional controls are no, again, we all have systems to protect us. They can pick up everything. They can monitor as much as they want. But the human firewall is a behavioral bypass, right?

14:46 It's a culture where trust but verify is replaced by verified to trust. You know what I'm saying? It's kind of the reverse psychology of it. It's about building a standard operating for identity that doesn't rely on biological senses, but a cryptographic or procedural certainty. And I think the human firewall, when I talk about it in my webinar, it's key things that you need to look for right when you are on a call or you're getting engaged with a voice or phishing, whatever it might be.

15:19 And it's critical that you kind of transcend that at this point. People have to use the human firewall because as I said earlier, it's so important. The human security in this is going to be the key to protecting your business even more and more. Interested in it? And it says. Now we see more reasons why people should attend this webinar, right?

15:40 So talking about the three channel rule right? Seems simple but powerful. Why does forcing the verification across voice, video and text dramatically reduce the risk of fraud? You know, that's a great question. You know, I'm going to go back to verify, to trust, right? It's about breaking the attackers scene. If you're talking to me on a video like we're doing right now, right, Channel 1, I will send you a code to your encrypted Slack channel and you must read it back to me. That's where the human firewall comes in. If it's a deep fake, the attacker likely doesn't have access to your internal authenticating messaging in real time unless they've hacked your system. It forces the synthetic actor to

16:25 interact with the physical or authenticated reality that they don't control. So think about that, right? That's where these AI's breakdown and we talked about that in my webinar and how to spot that. And that's why it's important to use the three channel rule, right, to protect yourself even further than what we're actually doing right now. It's not just about MFA and having that protection. This goes deeper than that and shifting the way your business operates to protect yourself.

16:55 It's interesting the way the world is evolving. We're moving from 2 factor authentication to three channel rule. So Speaking of internal deepfakes and the LIES dividend, one of the most unsettling ideas you raised is the LIES dividend, where leaders themselves can possibly deny reality. So why is this an internal cultural risk as much as a security risk?

17:23 You know the liars Dividend is a nightmare for governance, let's face it. OK? I mean risk governance is very difficult to begin with. It's the idea that a leader caught doing something wrong can simply claim that was a deep fake. This creates a vacuum of accountability, and that's what the problem is here. If we can't prove what is real, we can't hold anyone responsible.

17:50 It erodes the very fabric of corporate culture. Think about that, right? Think about what that can do to your organization. If your employees get an e-mail from you, right? Or it's sent from a disgruntled employee and they think it's the CEO of your corporation and they don't know any better, will they follow that directive, right?

18:10 You got to make sure that you're monitoring all facets, right? The liar's dividend is don't lie to yourself, right? Be honest with what you have in place and what you don't have in place. And I don't care how big or how small you are, this applies to anybody even on a personal end, right? How do you protect yourself in a world of AI today? Great question.

18:29 There's a lot of unintended consequences and with accountability responsibility being attacked, it's the stakes are very, very high. But Speaking of the board level accountability, if you were briefing a board tomorrow, what are the three non negotiable questions every director should be asking management about deep fake readiness?

18:58 You know, I share this now with all of my clients, right? Whether you're at a board level, a director's level, it doesn't matter. So like at a director's level, you should ask, do you have a proof of life protocol for high value transactions #1 right? Because we know fraud, wire fraud is very big right now with using the AI, eugenics and scams. You know, how is our crisis management plan adapted for an identity takeover scenario?

19:31 Do you have a plan in place to even know how to spot it? What protocols are you following? Do you have an incident response plan? Do you have a backup plan for your reputation? Most important, I would say, what is our zero trust architect for human to human communication? I think that's the number one question that you should refer to and anything that you're doing today, especially in the cybersecurity world, right? We have zero trust for everything else protecting our systems, right?

19:56 But what is it for the human to human communication? I think those would be my 3 questions that I throw out. Out to everybody. Trustworth verify verify then before trusting back. It's now becoming a loop right? But what are most companies still missing? Verify to trust. You know, despite all the headlines, what critical mistakes do you still see organizations repeatedly making when it comes to AI enabled fraud defense? I think most companies are still missing the fact that they're still treating this as an IT problem, OK? It's not an IT problem.

20:34 It is an operations and culture problem. You know, companies spend millions on firewalls but zero on training their executives how to handle FaceTime call from a kidnapped, you know, Zoom meeting, which is how these attackers are often gaining leverage, right? It's not about the ransomware attacks anymore.

20:55 You have systems in place to protect you on that, right? This is different. It's not an IT problem. Step back, look at it. Go through your, your, your pyramid. However you have your company organized, structured in the compliance and risk end and ask those hard questions. Where are the gaps, right?

21:10 We call it, you know, I always call it a TOC, right? That's what I use in my business everyday. Identify the bottlenecks and clean them up. Clean up those processes. Very important. Speaking of cleaning up, right, let's talk about immediate executive actions. So for the leaders, for the founders listening to us today, what are the actions they should take in the next 30 days to reduce that exposure to deep fake driven fraud? I think number one step should be to sign up for your webinar. And what other steps do they take? Listen, the advice I give today will probably change three months from now and 12 months from now, right? But as of today, I think the most important thing is to establish a safe word,

21:52 especially on any kind of transactional thing that you're doing within your environment. It's most important, whether that's personal or through business, establish those safe words. So if you do need to call somebody to verify something, only that person's going to know that safe word, right? It creates a non digital phrase for your family and your direct reports.

22:12 And one thing I think it's very important today, right? And then audit your digital footprint. If you haven't done this, you better, right? Especially with now everything changing to AI and how all of these platforms and these search engines are going to be, you know, promoting your businesses. The shift in all of that is very critical, right? Know what audio video of you is public. I think it's very important.

22:40 Audit it, right? We're all on these podcasts. It doesn't mean one of these tools can't take what you and I are discussing, mimic my voice and get on a platform and make something different because that's what they're doing. Let's talk about the reality of it. So that's critical. And then normalize the friction, right? Tell your team, normalize it, right? Tell your team that you will never be offended if they challenge your identity on a call. Let them know that it's OK, that you're not comfortable and there's tools that you can put on. Use these calls today that can spot if there's somebody else on that call that shouldn't know if it's a deep fake. If you have the money and you can afford it, use them. Use them, otherwise you lose it.

23:24 Yeah, use it or lose it. Can you afford, I'm going to just throw this out there. Can you afford to lose $100,000 today? I tell everybody that when I speak to them about right, the AI, you know, pandemic, I like to call it the 2026 pandemic of the deep fake. Can you afford to lose 100,000? Think about it.

23:44 Not many people could afford that. Not many people could afford that. I, for one, cannot afford to lose that. You know, let's take this personal right now. On a personal level, your personal perspective. How has your understanding of deep fakes changed how you communicate or verify information in your own life?

24:05 Well, you know, I hate to be a cynic, right? But absolutely, I've become a digital cynic. I no longer take any inbound communication at face value. I don't. You have people reaching out to you on all different types of platforms, trying to introduce themselves, tell you their services. You don't want to collaborate with you.

24:21 You don't know who's real and who's not making job offers. It could be anything, you know? I think it's critical, right, that you no longer take any communication at face, regardless of how familiar the voice sounds. I'm going to just say that I've been, I've implemented myself the three channel rule with my own family, my, my own business, just paranoia. It's digital hygiene and that's the way I look at it, right? You got to clean up and control what you can control because there's many things out there you can't control. You're never going to be able to control and stop the hackers from getting better and better and, you know, training these tools to do what they have to do. I'm anxious to see what comes

24:56 out next, you know, after this whole nuts, nutty thing that's going on. But that's what I would probably say, right? Do what you can do to protect your space and your business. And if you don't know. Protect yourself at all. Times plenty of webinars out there and go online yeah at all times, right.

25:13 There's plenty of information out there how to do this, you know, do it, you know, invest, invest in it. Invest in the time to do this for yourself and your business. Wow, quick plug guys, invest in Michelle's forthcoming webinar looking into the future. I know you're not a futurist, you're not Nostradamus, but you are an expert.

25:37 You are the pro. I am the Joe. So if we look ahead into 2027 and beyond, what would separate the organizations that survive this pandemic, the pandemic era, as you call it, right, of synthetic reality from those that do not survive it? What's going to be the disagreeation factor? I think the survivors will be like protocol driven organizations.

26:02 I think that's the key. If I had to say it right, they're going to do the work. They're going to figure out the bottlenecks and their compliance. They're going to implement and change how their employees interact, send money, right? The biggest thing, but I think those who rely on gut feeling or familiar voices will be dismantled again. It's shifting from trust to verify to verify to trust. You can no longer just rely on what you think. You know I'm not above that, right? The future belongs to leaders who understand that in a world of synthetic reality, because that's what we're in. The only thing that cannot be faked is a pre agreed out of band protocol.

26:44 That's the bottom line. If you drive protocols and make them simple, don't make them complicated, right? We're all neurologically learning and the simpler you keep it for your employees and keep it for your organization for them to remember is going to be critical, right? We all have on our desktop the ability to put.

27:03 The tone at the top is important. It comes, it's top down. It's always been top down. That's how you build your culture, your mission and everything else. And people who work under other people, I've worked for large corporations, you know, did I believe in their mission? Of course, because that was the culture that they actually drove.

27:19 Have I worked for corporations that they say a mission and it wasn't what they followed? Absolutely. So don't be one of those, is what I'm going to say. Interesting stuff. So we know Michelle is actually a very, very busy expert. But before you go, I have just one more question for you. Why should the business leaders, the founders, the professionals, you know, everyone and their mom listening to the podcast today, Why should they attend your webinar? And what is the the value they are going to gain? What are the details?

27:56 Well, thank you for sharing my webinar with everybody today and I really do hope that they sign up and they come right. I think the moment digital trust broke for everybody, it's the rules fundamentally change when we move from static, a fake e-mail to real time synthesis, a live call, a live video call.

28:13 Think about that. The death of trust happened the moment we could no longer rely on your eyes and ears to verify identity. That is the problem when seeing is no longer believing the social contract of digital communication is essentially voided. Think about that. I will tell you what they're going to learn if you come is you're going to learn some key protocols that you can do to protect your business.

28:35 Why we're going to talk a lot about the human firewall. You're going to walk away with a couple of PDFs that will help your business structure and build those protocols within your environment, which I think is key, right? This is not just about me talking. This is about me showing and telling you and taking a look at what this looks like in live sentence, discussing the statistics and where we're going with it.

28:56 So I do appreciate you giving me this platform today to kind of share my thoughts, but also giving an opportunity to others out there to please come join, right? I think it's essential that you do this training and help yourself, but those are some of the key things that we're gonna be doing on our webinar. An attitude of gratitude is good attitude. When a person shares their time with you, they share their life with you because the SI uniform measure and life is time. So thank you very much for sharing your life and your time today on the podcast.

29:25 And thank you for helping me to achieve my goals. My goals are to educate and to motivate. And with that, I think my job is done. So I am privileged to have the best and the brightest minds of my generation to help be to achieve, you know, the two goals that I set out to achieve. So it's love and of course, respect to you. Do you want to leave a shout out to anybody before you leave? Listen, my shout out is back at you, right? The work that you are doing fundamentally across the global stage is so valuable and the people that you bring, I never do that right.

30:03 But the people that you bring onto your platform to share, just like me, I've listened to some of these podcasts and speakers that you've had valuable. Like if anybody needs to get real life direction, it's your podcast. And I don't just say that because, you know, you and I have done podcasts together.

30:22 I say it because it's it's true. So thank you so much and for giving me the open opportunity to speak today, share my current situation with everybody and hopefully you and I will see each other in the future again. Thank you very much. It means a lot to me when people appreciate the body of work because people don't see what goes on behind the scenes.

30:41 A lot of hard work, a lot of effort, a lot of investment, you know, financially, not financially, but it's it's always great to have that appreciation. Thank you very much once again. And of course, the audience conceive, belief, strive to thrive and achieve. Always go for something in your life.

31:01 And of course, till I come your way again, keep winning. God bless guys.