Chapter 12 of 1214 min read

Building an Organisational Defence Framework

Every control here is traced to the claim that justifies it, and every metric is one you can compute without knowing whether you have been attacked.

What eleven chapters did to the framework

This book opened with a five-layer framework and called it a thesis rather than a finding. It is worth being explicit about what the evidence did to it, because two of the five layers turned out to carry almost none of the weight originally assigned to them, and the sequence implied by drawing them as a stack turned out to be wrong.

The layers are not filters arranged in series, where material passes one to reach the next. They are independent failure points, and the attacker chooses which to engage. Arup was decided entirely at Layer 4 with Layer 2 never consulted. Slovakia was decided at Layer 4 and Layer 5, by a moratorium rule and a platform policy gap. The New Hampshire payload travelled by telephone, bypassing Layer 3 altogether.

Figure 12.1 — The same five layers, reweighted. The arrows are the correction: the layers are independent entry points rather than a sequence, so a stack diagram overstates how much protection the upper layers provide. Source: author’s synthesis over the cited claims.

Learning objectives

Rank candidate controls by the evidence supporting them rather than by convention or cost.
Identify commonly recommended measures that this book found no evidence for.
Construct indicators that can be computed without knowing whether an attack occurred.
Sequence implementation by lead time, recognising which control must start first despite paying last.
Assign each control to an accountable function, including the two that are usually unowned.
State what would falsify this framework.

The control set, ranked by evidence

Security frameworks are normally consensus documents. This one is not: every control below carries the claim that justifies it, and controls with no supporting evidence in this book are listed as such rather than quietly included.

Rank	Control	Why it earns the position	Evidence
1	Out-of-band verification, specified in three properties you initiate; to an address you already held; on a different channel	Stopped three of six documented attacks and was absent from all three losses. Does not degrade with synthesis quality. Independently recommended by the FBI.	C3.01, C3.04, C3.05, C9.01
2	Authorisation paths with no single-channel route the channel carrying a request cannot also approve it	Every loss occurred where one channel both initiated and authorised. This is where the money actually moves.	C1.01, C3.02, C3.03
3	Originals retained with provenance signed at capture; not a re-encoded copy	The only answer to a raised authentication burden, and unavailable retrospectively. Longest lead time of anything here.	C10.01, C11.03
4	A pre-authorised rapid denial route named people who may speak without further sign-off	Slovakia was decided by the rebuttal window, not the forgery. The binding constraint in an incident is approval, not evidence.	C2.01, C2.02
5	Signing your own output with key custody treated as the actual asset	Effectiveness does not decay as generators improve. Returns are collective, so pair it with sector and procurement pressure.	C10.01, C10.04, C11.04
6	Withdrawal of AI-text detection from decisions about people a removal, not an addition	61.22% false positives for non-native English writers against roughly 5% for native writers. Published, mechanistically understood, therefore foreseeable.	C8.01, C8.02
7	Deliberate red-teaming of any deployed detector commissioned adversarial submissions, measured	The only way to obtain a failure signal the environment does not provide. Without it, years of quiet service is not evidence.	C7.01, C7.03
8	Population-level monitoring for synthetic identity cross-account, not in-interaction	The one case where out-of-band verification has no counterparty, so it must be caught somewhere else entirely.	C3.06, C9.03
9	Detection, inside its envelope only observable generators, adequate prevalence, triage not verdict, never published	Earns a place in a closed funnel where attacks concentrate. Ranked ninth because the conditions rarely hold and expiry is unannounced.	C4.02, C4.05, C6.01

Table 12.1 — Nine controls, each traceable to a ledger claim. Note that the top two are old, cheap and procedural, and that one of the nine is a withdrawal. Source: author’s synthesis.

Commonly recommended, and not evidenced in this book

These appear in most synthetic-media guidance. None is supported by anything established here, and two are contradicted.

Training staff to recognise deepfakes. Four for four, the heuristics consumed by synthesis were content judgements. No documented case was decided by anyone identifying an artefact as synthetic.
Procuring detection for open-population content. Precision collapses at institutional prevalence, and the false positives are accusations against authentic material.
Publishing detector verdicts. An attack surface in both directions, inbound discrediting genuine material.
Voice biometrics as a primary factor. A public identifier that cannot be rotated, with a three-second acquisition cost.
Relying on legal deterrence of originators. The best-documented penalty appears uncollected.

Absence of evidence here is not proof of uselessness, and it is a reason to spend after the nine above rather than before them.

Measure the controls, not the threat

Chapter 7 established that content authenticity has no feedback channel: a successful evasion is indistinguishable from authentic material, so a deployed detector’s real-world failure rate is unmeasurable in principle from the defender’s side. That finding has a constructive consequence for framework design that is easy to miss.

If you cannot measure the threat, build the programme on indicators of your own controls, all of which are computable without knowing whether anyone has attacked you. This is the opposite of the usual dashboard, which counts incidents and flags and therefore reports the attacker’s activity rather than your readiness.

Figure 12.2 — A dashboard of readiness rather than of threat. Every figure is obtainable from your own records and processes. Source: author’s synthesis over C2.01, C3.03, C7.03, C8.02, C10.01, C11.03.

0 of 6Cases decided by detectionAcross every documented corporate case with a named organisation.

61.22%Text-detector false positivesFor non-native English writers, against roughly 5% for native writers.

0.0005AUC under attackFrom 0.95, by flipping the lowest bit of each pixel.

$6mOrdered, not collectedAgainst an identified defendant who admitted the conduct.

Sequencing, by lead time rather than by priority

Ranking controls by evidence tells you what matters. It does not tell you what to start first, because the control with the longest lead time is not the one with the highest rank.

Start immediately, pays in years. Originals and provenance. Retention and capture decisions determine what you can produce in a dispute three years hence, the evidentiary rule that will raise the burden does not yet exist and so creates no prompt, and nothing can be reconstructed retrospectively. This is the only item whose deadline is set by litigation rather than by regulation, which is to say by someone else.

First ninety days. Rewrite verification guidance into the three explicit properties. Count your single-channel authorisation paths. Name the people who may issue a denial without further sign-off, and measure the rebuttal window as it actually stands at two in the morning. Withdraw AI-text detection from decisions about people. Four of these are policy, cost almost nothing, and address the two highest-ranked controls plus the one withdrawal.

First year. Signing for your own output, with key custody assigned. Red-teaming for any detector in service. Population-level monitoring where synthetic identity is a live risk. Sector and procurement engagement on provenance adoption, because those returns are collective and nothing you do alone produces them.

Two controls that are usually unowned

The rebuttal window belongs to communications, legal and the executive office jointly, which in practice means nobody has measured it. It is not an information security metric and will not appear on a security dashboard, yet it decided the Slovak case.

Content signing key custody has no conventional owner at all. It is not a TLS certificate, not a code-signing key and not a document seal, and in most organisations the role does not exist. Until someone holds it, the provenance control cannot be implemented regardless of budget.

Practical scenario

Illustrative scenario · not a documented incident

Your board allocates a budget for synthetic media risk and asks for a plan at the next meeting. The security function proposes detection tooling and staff awareness training, which is what the market offers and what peers have bought.

Write the alternative on one page, using Table 12.1. Show which of the two proposals appears in the evidenced list and where, state the six indicators you will report instead of incident counts, and name the owner of the signing key. Then be ready for the hardest question: why does your plan contain a withdrawal and no purchase in the first ninety days?

Executive implications

The first ninety days should contain no procurement. The two highest-ranked controls are policy wording and process design, and the sixth is a withdrawal. Anything that must be bought ranks fifth or lower.
Report readiness, not incidents. Replace flag counts and “no known evasions” with the six indicators in Figure 12.2. The first is a guaranteed observation and misleads boards in a specific, correctable way.
Start retention and provenance now, out of sequence. It ranks third and must begin first, because its lead time is years and no regulator will prompt you.
Assign the two unowned controls explicitly. A rebuttal window with no owner has never been measured, and a signing key with no custodian makes provenance unimplementable.
Treat provenance adoption as a collective project. Your own signature buys little until absence is informative, so sector bodies and procurement requirements are the instrument, not internal business cases.
Expect no help from deterrence, and plan for intermediary remedies. Know the statutory takedown route before you need it, for the organisation and for your people.

Common misconceptions

Misconception 1 · “This is a technology problem, so it needs technology”

The two best-evidenced controls are a rule about who dials whom and a rule about who may approve what. Both predate synthetic media by decades. The technology changed which of your existing controls were load-bearing; it did not change what a control is.

Misconception 2 · “A framework should be comprehensive”

Comprehensiveness is how consensus documents accumulate measures that nothing supports. This framework is deliberately short, ranks by evidence, includes a withdrawal, and names five commonly recommended measures it does not endorse. A list of everything is a list that cannot be sequenced.

Misconception 3 · “We will know if our controls are working”

Not for detection, where failure is unobservable by construction. You will know whether your controls are in place, because that is measurable. The distinction is the whole reason Figure 12.2 contains no threat metrics, and accepting it is the maturity step most organisations have not taken.

Limitations and what would change the conclusions

The documented case base is six corporate incidents and a handful of election cases. That is what the public record supports, and organisations that lost money quietly are absent. The uniform result on detection should be read as a strong absence of evidence, not as proof.
The ranking is argued, not validated. No controlled comparison of these controls exists, and none is likely. A reader who weighs the cases differently can reasonably reorder ranks three to nine; ranks one and two rest on the clearest evidence in the book.
What would falsify the framework. A documented case in which detection, rather than process, determined the outcome would move Layer 2 up. A measured deployment showing stable precision at low prevalence would reopen Chapter 4. Evidence that attack volume against mid-value targets has not risen would withdraw the agentic argument of Chapter 9. Each of these is a specific observation, and the framework should change if any of them appears.
Two ledger claims remain Emerging and cannot be improved by further reading. C2.03 rests on reporting at a point in time; C3.02 rests on an insurer’s account of a claim against an unnamed company. They are marked rather than scheduled.
The book takes no position on several real questions. Over-removal harms from statutory takedown, the privacy cost of provenance to sources at risk, and the disparate impact of coordination analysis are each raised and left unresolved, because resolving them requires value judgements rather than evidence.

Teaching materials

Discussion questions

The two best-evidenced controls require no new technology. Why does the market offer mostly technology?
Should a framework ever include a measure with no supporting evidence? Under what conditions?
Which of the six indicators would your organisation find hardest to compute, and what does that difficulty reveal?
Who should own the rebuttal window, given that it spans communications, legal and the executive office?
If detection failure is unobservable, is deploying detection ever defensible outside a closed funnel?

Assessment questions

Reconstruct Table 12.1 for your own organisation, with owners and current status for each control. (25 marks)
Explain why the framework is sequenced by lead time rather than by rank, with the worked example. (10 marks)
State three observations that would falsify parts of this framework and explain what each would change. (15 marks)

Practical exercise

Compute all six indicators in Figure 12.2 for your organisation this week. Record which ones you could not compute at all. That list is your actual starting position, and it is more useful than any maturity score.

Research assignment

Take any published synthetic-media guidance and score each of its recommendations against the evidence standard used here: documented case, primary source, or neither. Report the proportion in each category.

Seminar topic

“Evidence-ranked frameworks are better than consensus frameworks, and that is why nobody publishes them.” Argue either side.

Chapter synthesis, and the book’s

The argument of this book can be stated in four sentences. Generation is not controllable, and the cost of imitating a person has fallen to three seconds of public audio. Detection is an instrument with a narrow envelope, five independent reasons its published performance does not transfer, an unpublished expiry date, and no means of telling you when it has failed. Provenance is the only control whose effectiveness does not decay as generators improve, and its value is collective rather than individual, which is why mandates matter more than business cases. And in every documented case where money moved or did not move, the outcome was determined by institutional process, by whether one channel could both request and approve, and by whether anybody had to be reached on a path they did not choose.

That last finding is the one worth carrying. It is also the least satisfying, because it says the answer to a novel technological threat is mostly old administrative hygiene: a question whose answer is not published, a number from your own directory, a second approver contacted separately, a named person permitted to speak at two in the morning without waiting for sign-off, and a retained original of anything you might one day have to prove. None of it is interesting. All of it held.

The uncomfortable corollary is that the industry grew up around the layer that does not hold. Detection attracts the research, the procurement budgets and the vendor claims, and it is the layer where the evidence is weakest, the feedback is absent and the harms of error fall on identifiable people, overwhelmingly on the ones least able to contest an accusation. A twelve-fold disparity in false positives against non-native speakers is not a rough edge on a working tool. It is what the tool does.

This book has tried to be wrong in visible ways rather than right in vague ones. Forty-seven claims carry identifiers, sources and stated limits; two remain marked as weak because their sources cannot be improved; the three analytical claims that do most of the work are labelled as analysis rather than dressed as findings; and Chapter 9’s prediction about agentic attack volume is written so that it can be shown false. If the framework in Table 12.1 is wrong, it should be wrong in a way a reader can demonstrate. That is the most useful property a book on this subject can have, in a field whose central difficulty is that nothing tells you when you have been fooled.