Defending Against Executive Deepfake Fraud: A Hybrid Detection Framework and Governance Strategy for Enterprise Security

Deepfake technology has moved well beyond research laboratories, with synthetic video and audio now being deployed to commit corporate fraud, impersonate executives, and manipulate employees at scale. Most detection systems in the research literature fail in three recurring ways: they perform well in controlled tests but poorly in real deployment; they handle only one modality at a time; and they require computing resources that most organisations do not possess. This research addresses these problems through a detection framework built on a fine-tuned EfficientNetV2-S visual backbone combined with three independent Radial Basis Function (RBF) Support Vector Machine (SVM) classifiers, covering visual, audio, and combined audio–visual detection, with the classification stage adding 2.3 ms per frame to a pipeline that requires 195 ms per frame on a single CPU thread. Evaluation followed the official FaceForensics++ source-video split, with all partitioning performed at video level. On FaceForensics++ C23, the visual classifier achieved an AUC-ROC (Area Under the Receiver Operating Characteristic Curve) of 0.9848 (95% CI 0.9787 to 0.9898) at the frame level and 0.9937 at the video level, with an accuracy of 95.53%. On a held-out DeepFakeDetection subset comprising unseen-manipulation methods and subjects, AUC-ROC was 0.9689. Cross-dataset evaluation on Celeb-DF v2 without retraining produced an AUC-ROC of 0.6589, a drop of 32.59 percentage points, with 65.6% of real frames flagged as fake at the inherited operating threshold; a recalibration experiment shows that no operating point on that curve is usable. On the full ASVspoof 2019 Logical Access evaluation partition, which contains thirteen attack types absent from training, the audio classifier reached an equal error rate of 16.55% (95% CI 14.70 to 18.40), ranging from 0.36% on the most detectable attack to 33.43% on the least. A controlled ablation on FakeAVCeleb v1.2, using identity-disjoint partitions and separate labels for each modality, showed a visual-only AUC-ROC of 1.0000 and audio-only of 0.9884. Score-level fusion reduced AUC-ROC to 0.9776 (DeLong p = 0.016), because averaging discards information when video and audio are manipulated independently. A governance framework is presented that maps each technical limitation to a specific organisational control, grounded in proportionality, independence, and adaptability and aligned to ISO/IEC 27001:2022 Annex A, the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the NIST AI Risk Management Framework. The detection results establish that this governance layer cannot depend on detector output once the deployment domain differs from the training domain.