The most dangerous person in your company might not work there at all. The spread of audio and video deepfakes, ever cheaper and more convincing, is fueling a new wave of attacks: hackers impersonating the CFO during a video call, the assistant requesting an urgent wire transfer, the IT technician asking for credentials for a critical intervention. The security industry has already coined a label for this threat: the “synthetic insider.” Not a real employee, but convincing enough to bypass controls based on trust and familiarity.

The problem is not new. Insider threats—from careless workers to deliberate moles—have been a thorn in the side of security managers for decades. But the synthetic insider changes the game because it does not require physical access or account compromise: all it takes is a credible digital clone, generated perhaps from a few seconds of voice stolen from a public video or a fake video call built with open-source generative models. The barrier to entry has collapsed, and the damage can be immediate: fund transfers, intellectual property theft, exfiltration of personal data.

If the threat becomes synthetic, the defense must also shift gears. It is no longer just about teaching users to spot suspicious emails or hardening the network perimeter. A well-executed deepfake can defeat voice or visual biometric checks if these rely on third-party cloud services. This is where on-premise architectures and sovereignty over authentication data become strategic arguments. When inference for facial or voice recognition runs on company-controlled infrastructure, there is no external endpoint to intercept and no cloud provider that could become a supply chain attack target. Moreover, latency drops and TCO, for medium-to-large organizations, can be favorable compared to monthly fees multiplied by thousands of users.

It’s not just a matter of trusting the vendor. The synthetic insider thrives on speed: the attack works if it can bypass the human factor within minutes. Verification systems based on LLMs and deep learning models must respond in real time, analyzing micro-expressions, speech coherence, behavioral patterns. An on-premise deployment allows customizing models on internal datasets, optimizing quantization to run on corporate GPUs, and keeping the entire process under the security team’s control, without voice or video data ever leaving the company perimeter. For organizations in regulated sectors—banking, defense, healthcare—this is also a compliance requirement that GDPR and equivalent regulations make non-negotiable.

Of course, for many SMEs the cloud remains the most accessible route, but the trajectory is clear: as deepfakes become indistinguishable from reality, identity verification will increasingly shift toward self-hosted or at least hybrid systems, where critical recognition happens locally and only anonymized metadata reaches external services. This is not science fiction: some companies are already integrating deepfake detection models into their multi-factor authentication flows, turning the employee’s face and voice into an additional biometric factor verified on-device.

The synthetic insider forces us to rethink the architecture of trust. We can no longer afford to believe what we see or hear digitally without independent verification, and that verification must be as detached as possible from infrastructures we do not control. The next generation of attacks won’t knock on the door: they’ll open it with our colleague’s face.