Senior managers in Singapore are more than twice as likely as clerical workers to comply with an AI-cloned CEO voice before verifying it, according to the study, Would You Know Your CEO’s Real Voice? Singapore’s Growing Deepfake Vulnerability.
The findings challenge the assumption that experience and seniority automatically improve resilience to AI-enabled executive impersonation.
The conclusions are based on a Censuswide survey of 500 Singapore-based office workers and examines how voice cloning and deepfake technology exploit workplace hierarchy.
KnowBe4 found that 36% of respondents were not confident they could distinguish a genuine CEO message from one generated using AI. At the same time, 50% said they would feel uncomfortable challenging a request from a senior executive, while 52% would worry about negative consequences for doing so.
The research identifies two distinct vulnerabilities. Junior and middle-tier employees may hesitate to question authority, while senior managers may be overconfident in their ability to identify a fake.
Although 78% of senior managers said they were confident they could spot a deepfake, 35% said they would comply with a cloned CEO voice before verification—more than double the 16% recorded among clerical workers.
The pressure to respond quickly compounds the risk. Some 45% of workers said they would be equally worried about delaying a senior leader’s request as about accidentally causing a cybersecurity incident, while 9% said they would rather risk a breach than delay the boss.
Training remains limited. Only 26% of respondents had received specific training on AI-generated scams involving senior leaders, and that training was concentrated among senior managers—the group identified as most at risk. Just 10% of respondents viewed employees trusting senior leaders too readily as their workplace’s greatest cybersecurity risk.
“In Singapore, hierarchy works like a trust shortcut, one that AI-enabled scams are now designed to exploit,” said Dr Kawin Boonyapredee, CISO advisor at KnowBe4. “A cloned voice or a convincing message from ‘the boss’ doesn’t need to fool the technology. It only needs to activate an instinct not to question authority.”
KnowBe4 argues that technical controls alone cannot address the problem. Organisations need to create psychological safety so junior and middle-tier staff can challenge unusual requests, while senior managers need stronger verification habits rather than greater confidence.
The findings suggest that executive-impersonation defences should combine out-of-band verification procedures, clear escalation rules, role-specific simulations and training that addresses authority bias—not merely phishing awareness.
