Over a third of Singapore workers can’t tell real CEO messages from deepfakes, research finds

Senior managers are the most confident group at spotting a fake (78%), but are also the most likely to comply with a cloned CEO voice before verifying it (35%).

AI voice cloning and deepfake technology can now imitate a company’s most senior voice in minutes, using just a few seconds of publicly available audio. In Singapore, new research by KnowBe4 suggests many workers would struggle to spot the difference.

The study, conducted by Censuswide among 500 Singapore-based office workers between 6 and 11 August 2026, found that 36% would not be confident distinguishing a genuine message from their CEO from one generated using AI.

Fear at the bottom: a culture where senior leaders aren’t questioned

Attitudes to hierarchy were split almost down the middle. 48% agreed that employees are expected to follow instructions from senior leaders without questioning them. 50% said it would feel uncomfortable to challenge a request from a senior executive, and 52% would worry about negative consequences if they questioned a senior leader.

At the same time, 48% agreed employees can safely question senior leaders without fear of repercussions, and the same share said their organisation encourages employees to question unusual requests.

Gen X (15%) respondents were more likely than Millennials (13%) and Gen Z (8%) to strongly agree that instructions should be followed without question. Men (52%) were more likely than women to agree overall (44%).

When asked what would make them hesitate, respondents cited:

• Fear of appearing disrespectful (40%)
• Fear of delaying important work (39%)
• Pressure to respond quickly (39%)
• Fear of disciplinary action (30%)

Weighing the wrong risk

Of the respondents, 45% said they would be equally concerned about delaying an important request from a senior leader and accidentally causing a cybersecurity incident. A further 9% would be more concerned about the delay. Just 41% said they would be more concerned about causing an incident.

Asked what creates the greatest cybersecurity risk today, respondents pointed to employees not recognising AI-generated scams (26%), a lack of cybersecurity training (19%) and employees being too busy to stop and verify requests (18%).

Meanwhile, over three in five (62%) agreed their organisation empowers employees to question suspicious requests from senior leaders, even if they appear urgent. Senior managers were far more likely to agree (82%) than middle managers (63%), junior managers (50%) and clerical workers (51%).

Overconfidence at the top

Respondents were asked to imagine an urgent WhatsApp message from their CEO, asking them to transfer confidential company information because the CEO was travelling. Most said they would take a verification step first:

• Report it to IT or security (25%)
• Call the CEO using their usual number (23%)
• Verify through another colleague (21%)
• Send the information immediately (8%)

In a second scenario, a voice that sounded exactly like the CEO’s asked them to urgently bypass a normal approval process. Some 61% said they would be unlikely to comply before independently verifying the request, but 23% said they would likely bypass normal approval processes, including 5% who would be very likely to.

Confidence was highest among senior managers, with 78% saying they could tell a real message from an AI-generated one. This compares with 61% of middle managers, 48% of junior managers and 49% of clerical workers.

Yet senior managers were also the most likely to comply with a cloned CEO voice before verifying it (35%), ahead of middle managers (23%), junior managers (21%) and clerical workers (16%). The report described this as an inverse relationship between seniority and caution.

Training gaps

Just over a quarter (26%) of respondents receive training specifically on AI-generated scams involving senior leaders. Another 27% receive general phishing training only, 17% have received training but don’t recall whether it covered AI scams, 11% rarely receive cybersecurity training, and 12% receive none at all.

That training is concentrated at the top: 39% of senior managers have received it, compared with 23% of middle managers, 22% of junior managers and 12% of clerical workers. Respondents at multinational companies were also more likely than those at local or national companies to have received it (34% versus 20%).

On AI-enabled threats, respondents were most concerned about AI-generated phishing emails or impersonation messages (61%), followed by AI-generated documents (56%), deepfake video calls (55%) and voice cloning (53%).

Building trust that can’t be faked

The report concluded that the findings point to two separate vulnerabilities. Junior and middle-tier staff need genuine psychological safety to question a senior-sounding request, while senior leaders need better verification habits, not more confidence.

“A cloned voice or a convincing message from ‘the boss’ doesn’t need to fool the technology. It only needs to activate an instinct not to question authority,” said Dr Kawin Boonyapredee, CISO advisor, KnowBe4.

He further added that the gap can be addressed through training that changes behaviour across all levels of seniority, rather than focusing solely on raising awareness among senior leaders.

Read full research here.

ALSO READ: 57% of SEA organisations surveyed remain stuck at the AI pilot or deployment stage