Chris Allen, Co-Founder & CEO of Red5 with 20+ years of experience in video streaming for developers, enterprises, and government.
A deepfake presented as a file gives investigators time. A deepfake delivered during a live executive call, earnings discussion or public broadcast doesn’t. By the time a conventional review produces an answer, money may have moved, confidential information may have been disclosed, or a false statement may already be circulating.
That compressed decision window is what makes live video a distinct business risk. The danger is that a detection system will appear authoritative enough to create false confidence at the exact moment when people must act.
A 2025 Gartner Inc. report found that 43% of surveyed cybersecurity leaders had encountered a deepfake incident in an audio call, and 37% had encountered one in a video call. Live synthetic media is already an operational issue for organizations that use video to authorize decisions, communicate with employees or address the public.
Why is live detection harder?
While most of the public discourse on deepfakes focuses on pre-recorded video-on-demand use cases, my focus in this article is on a much harder problem: live video.
Deepfake detection and generation are developing in response to each other. Detectors learn to recognize inconsistencies in facial movement, lighting, voice patterns or image structure. Generators can then be trained to reduce those same artifacts. Every useful detection method can become feedback for the next generation of fakes.
Real-world video adds more uncertainty. Compression can remove subtle signals. Network conditions introduce artifacts. Cameras, lighting, microphones and participant behavior vary. A U.K. government review of deepfake detection described the field as being in the “early stage” and identified reliability concerns, limited representative training data and inconsistent accuracy measures as barriers to adoption.
Live video adds an additional level of complexity that requires almost instant detection, low-latency alerts and robust systems that aren’t needed when dealing with pre-recorded content. In a live environment, accuracy is only one requirement. A result must arrive soon enough to change the outcome. A detector that flags an impersonator after a payment has been approved is useful for an investigation, but it’s not an effective preventive control.
Provenance helps, but it doesn’t decide what’s true.
Provenance offers a complementary defense. Instead of asking only whether media looks synthetic, organizations can examine cryptographically connected information about where it came from and how it moved through a media workflow. C2PA version 2.3 introduced Content Credentials for live video, extending this approach to broadcast and streaming applications.
That’s meaningful progress, but a valid credential isn’t a universal truth certificate. C2PA’s own guiding principles state that its specifications should verify whether provenance assertions are associated with the content and free from tampering, not judge whether those assertions are good or bad. A properly signed stream could still capture a staged event, while an authentic stream may arrive without credentials because part of the delivery chain doesn’t preserve them.
For live video, provenance should be treated as another signal rather than a final verdict. The relevant business question isn’t whether the system displayed a green check but what this evidence allows you to conclude and what remains uncertain.
Build a response that assumes every signal can fail.
In my work with real-time video systems, adaptability has proved more durable than certainty. Organizations should avoid tying their strategy to one detector, one provenance method or one vendor. Their infrastructure should allow them to inspect live media quickly, combine different signals, replace detection services as threats change and route high-risk cases to human review.
The NSA, FBI and CISA guidance on deepfake threats similarly recommends a mix of real-time verification, passive detection, provenance techniques, response planning and employee training. That layered approach matters because no technical control eliminates the need for operational safeguards.
Business leaders should ask four questions:
1. Can our systems evaluate live video quickly enough to affect the decision?
2. Do we combine detection, provenance and contextual signals instead of relying on a binary score?
3. What happens when signals disagree, disappear or arrive too late?
4. Which actions always require confirmation through a separate channel?
A leader’s face and voice on a live call shouldn’t be sufficient authorization for a consequential transaction. Existing financial controls, escalation paths and independent verification should still apply.
Resilience is more valuable than certainty.
The deepfake arms race may never produce an undefeatable detector. Waiting for one or trusting a single confidence score can turn security technology into a new source of risk.
The better objective is resilience—evaluate multiple signals in real time, verify provenance where possible, and preserve human checks for consequential decisions. Organizations won’t defeat uncertainty, but they can design live video workflows that keep uncertainty from becoming false confidence.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?