Managing misinformation and disinformation risk in the age of AI

A landmark study confirmed the age-old saying that falsehoods spread faster than the truth.¹ An analysis in 2021 investigated the mechanisms for this, finding that false news is more infectious because it has a larger “cascade” as it spreads through a network.² Now that generative AI tools are just a few keystrokes away, creating and spreading untruths is potentially easier and faster than ever before.

As a result, misinformation (the unintentional circulation of false information) and disinformation (falsehoods created and circulated with malicious intent) are serious threats to political and financial stability. In a World Economic Forum survey, mis- and disinformation are the risk factors respondents felt likeliest to negatively impact the world over the next two years.³

The effects of mis- and disinformation on social and political discourse account for much of that perceived risk. But there are also serious implications for public and private organizations and businesses. Any organization that maintains a public identity or brand is a potential target for a disinformation campaign or could suddenly discover that misinformation about its status has flooded social media.

Generative AI is an accelerant that elevates the risk and potentially the effectiveness of disinformation campaigns and social engineering. The technology enables even unsophisticated actors to quickly create bogus stories and deepfake video and audio that can fool the public, shareholders and even employees into believing fabricated narratives. Within minutes, the targeted organization can sustain damage to its reputation, financial stability or relationships with clients and partners.

To prepare against this growing threat, organizations should consider how their messaging and branding might be manipulated by outsiders and be ready to counter fake narratives with truth.

Cybercriminals, nation-state actors, unethical competitors and other malicious actors can launch disinformation campaigns or engage with disinformation-as-a-service vendors to support a wide range of schemes.

For instance, the disinformation can target an organization’s staff in the form of deepfake video or audio of a decision-maker that instructs employees to send fraudulent payments or share sensitive information.

Criminals may also target an organization’s reputation by spreading false stories through social media and content platforms or even manipulating algorithms to extend the disinformation’s reach. This malicious activity might take the form of a fabricated news story that reports an earnings loss, or a regulatory investigation into a company, which could impact the stock price or customer confidence.

Combating false and misleading information can be difficult since it involves inexact science, especially when AI can concoct and distribute fabricated video, audio and written content so convincingly and rapidly. That said, organizations can defend themselves through preparation and plans for asserting a factual, controlling narrative even when a false one is circulating.

Here are a few keys to pushing back against mis- and disinformation:

As with many types of cybercrime, recognizing how organizations could be vulnerable to false information and why bad actors might attempt to use it against them is a critical part of preparation. All employees should be aware of the potential threat of internally directed disinformation (such as AI-generated fake communications), false narratives in the public realm and social engineering.

Mis- and disinformation have a harder time gaining traction if your organization has a well-defined digital presence and identity. No matter how visible the organization is, establishing a reputation and a voice can make fraudulent communications look more suspect and easier to counter with facts.

Keeping an eye on how media, influencers, competitors, customers and employees are talking about the organization can provide a detection mechanism if false information starts to proliferate. Monitoring is especially important whenever an organization’s activities are making news or it is conducting publicly visible business, as these could entice bad actors to attempt to sabotage the organization with disinformation.

Mis- and disinformation can be an insider threat as well, whether employees are careless or intentionally trying to damage an organization’s standing or reputation. Organizations should conduct training that educates employees about the risk of false information and set policies that can help reduce the risk of information shared on social media or other channels being misinterpreted or leveraged by bad actors in disinformation campaigns.

“When” is a better orientation than “if” when it comes to mis- and disinformation threats. Organizations should develop action plans that include counter-messaging and communication strategies that can blunt the impacts of false information.

¹Science, “The spread of true and false news online,” March 9, 2018.

²Proceedings of the National Academic of Sciences (PNAS), “Comparing information diffusion mechanisms by matching on cascade size,” November 8, 2021.

³World Economic Forum, “Global Risks Report 2024.”