A familiar executive voice can make an unfamiliar request sound legitimate. New KnowBe4 research from Singapore suggests that the employees most confident about detecting an imitation may also be among those most willing to act before checking. In a Censuswide online survey of 500 office workers, 35% of senior managers said they would likely comply with an AI-cloned CEO voice before independently verifying it, compared with 16% of clerical workers. These are reported intentions in a survey, not observed outcomes from a live attack or a controlled deception experiment. That distinction matters, but the gap still raises an uncomfortable organizational question.
The research was released during Singapore International Cyber Week and GovWare. The survey was conducted August 6–11, 2026, among Singapore-based office workers who use computers or email at work. Across the sample, 36% were not confident they could distinguish a genuine CEO message from an AI-generated one. Half said they would feel uncomfortable challenging a senior executive’s request, and 52% worried about negative consequences. Those findings describe an environment in which uncertainty about authenticity can coexist with pressure to respond.
The useful interpretation is that impersonation can exploit a decision process as much as a recognition failure. An employee does not have to be certain a message is authentic to act on it. They may decide that delaying the request carries a more immediate professional risk than complying. A convincing voice strengthens that pressure by supplying a familiar social cue. The attacker’s opportunity lies in persuading the recipient to treat apparent authority as sufficient authorization.
Seniority does not automatically resolve the problem. Experienced managers may know an executive’s voice well, understand the organization’s priorities and feel comfortable making urgent decisions. Those strengths can become weaknesses when they encourage a shortcut around independent verification. Recognizing a voice and confirming a request are different tasks. A person can be confident about the first while failing to complete the second, especially if the request appears consistent with a plausible business situation.
An appropriate organizational response is to make verification part of normal work. Sensitive payment instructions, changes to account details, credential requests and unusual data transfers should have an established confirmation route. That route needs to be independent of the incoming communication. Calling a known number from an internal directory, for example, provides a different check from using a contact detail supplied in the suspicious message. For higher-impact actions, a second authorized decision-maker can add another boundary.
Those procedures also need visible support from leadership. A policy is fragile if employees expect criticism for following it when the apparent requester is important. Executives can strengthen it by treating verification as routine and by accepting delays that the process requires. Training should include managers and people who approve exceptions, because an organization’s controls can be weakened by the very employees empowered to bypass them. Familiarity with the threat is useful; a dependable response is more useful.
The Singapore findings should not be generalized into a worldwide rate of vulnerability, and a vendor-backed survey is not a substitute for testing a particular organization’s controls. Its contribution is a specific warning about the interaction between confidence, hierarchy and action. As synthetic voices become part of the impersonation toolkit, businesses need to define what makes a request valid. The sound of the boss’s voice is a cue. It should not, by itself, be permission.