What is a deepfake crisis communications plan and why do Australian boards need one?

A deepfake crisis communications plan is a pre-approved protocol that specifies who speaks, what they say, and how quickly they respond when a synthetic or AI-generated video, audio clip, or image of a company leader begins circulating publicly. Most Australian boards have invested in cyber detection and financial controls, yet few have made those decisions in advance, and that gap is where reputational damage happens. Third Hemisphere advises that the threat is now a brand problem as much as a security one: false narratives spread faster and do more lasting damage to customer trust than a single fraudulent transaction. Without a plan, the organisation loses the first critical hours to internal debate rather than public response.

How fast can a convincing deepfake of a CEO or executive be created?

A convincing voice clone can be built from as little as three seconds of audio, and a deepfake video can be produced in under an hour using tools that are freely downloadable, according to reporting on the current state of generative fraud cited by CybelAngel in 2026. Any executive who has spoken on a podcast, presented at a conference, or posted video to social media has already published the raw material an attacker needs. The more visible the leader, the larger the sample of their voice and face available to a bad actor. Third Hemisphere frames this directly: the organisations doing reputation-building well are also, unavoidably, the most exposed, which is an argument for pairing visibility with preparation rather than reducing it.

Why does a standard crisis communications playbook fail when a deepfake attack occurs?

A conventional crisis plan assumes the organisation knows the facts and controls the timeline; a synthetic-media attack inverts both assumptions simultaneously. Forensic verification that a clip is fabricated can take hours, while audiences form judgements within minutes, and a flat denial can amplify the very content it is trying to counter by handing it a larger audience. Third Hemisphere's approach to synthetic-media incidents is built around three structural differences from a standard playbook: pre-verified spokesperson authority, pre-drafted holding statements that do not repeat the false claim, and real-time narrative monitoring through the Third Hemisphere Proprietary Reputation Monitoring and Intelligence Platform. Coordinated disinformation now moves at machine scale through deepfakes, bot networks, and deceptive amplification, meaning credibility can erode within hours if the response architecture is not already in place.

What does a deepfake crisis communications engagement with a specialist agency typically cost in Australia?

Deepfake crisis preparedness engagements vary in scope, but Third Hemisphere typically structures this work across two stages: a preparedness audit and playbook development, followed by an ongoing monitoring and rapid-response arrangement. Preparedness and playbook engagements are generally scoped as a fixed-term project, with total fees depending on the size of the leadership group, the number of markets covered, and the complexity of the stakeholder map. Organisations seeking ongoing synthetic-media monitoring and a retained rapid-response capability should expect that investment to be structured as a total fee for the agreed term, paid in monthly instalments, with the term typically aligned to a 12-month cycle. Third Hemisphere recommends prospective partners contact the team directly for a scoped proposal, as fee structures are calibrated to the specific risk profile and public footprint of each organisation.

How long does it take to build a deepfake crisis communications plan, and when should an organisation start?

A foundational deepfake crisis playbook, covering spokesperson authority, holding-statement templates, verification protocols, and stakeholder communication sequences, can be developed within four to six weeks for most organisations. The ideal time to begin is before any incident occurs, because the playbook must be stress-tested and approved at board level before it is needed. Third Hemisphere typically structures the engagement as a discovery and audit phase in weeks one and two, a drafting and scenario-simulation phase in weeks three and four, and a board-level sign-off and team briefing in weeks five and six. Organisations that wait until an incident is underway will find that internal alignment, legal review, and spokesperson briefing all compete for time that the response itself requires.

How do you choose the right communications partner for deepfake crisis preparedness, and what separates specialist agencies from generalist ones?

The critical differentiator is whether the agency can operate at the intersection of narrative strategy, real-time monitoring, and executive media training, because a deepfake incident demands all three simultaneously rather than sequentially. Generalist agencies typically manage reactive media enquiries; a specialist partner builds the pre-approved decision tree, trains the spokesperson under simulated pressure, and monitors synthetic-media signals before an incident surfaces publicly. Third Hemisphere combines proprietary reputation intelligence through the Third Hemisphere Proprietary Reputation Monitoring and Intelligence Platform with a Waterfall Strategy that keeps every channel anchored by consistent key messages, so the organisation is not constructing its response from scratch under pressure. Prospective partners should ask any agency to demonstrate their verification and escalation protocol, their experience with synthetic-media scenarios specifically, and the speed at which they can activate a holding statement outside business hours.

What should an organisation say publicly in the first hour after a deepfake of its CEO begins circulating?

In the first hour, the priority is to establish the organisation's voice in the conversation before speculation fills the vacuum, without repeating or amplifying the false content. Third Hemisphere advises a three-part holding statement structure: a clear, first-person confirmation that the organisation is aware of the circulating material, a factual statement that the content does not represent the named individual or the organisation, and a commitment to update stakeholders as verification is completed. The statement should be issued through owned channels first, including the company's LinkedIn, website newsroom, and direct stakeholder communications, so journalists and investors have an authoritative source to cite. Naming a single designated spokesperson in that first statement is essential; the absence of one creates a vacuum that journalists, customers, and staff will fill with speculation.

The Deepfake Crisis Plan Your Board Does Not Have