Being the boss does not automatically make you better at spotting a scam. A new KnowBe4 survey of Singapore office workers finds that senior managers report the most confidence in identifying AI impersonation, yet more say they would bypass approval procedures for a convincing imitation of their CEO.
According to KnowBe4’s report, Censuswide surveyed 500 Singapore-based office workers who use email or computers for work between August 6 and August 11, 2026. The questions covered executive impersonation, security training, and employees’ willingness to challenge someone above them.
One scenario asked respondents to imagine a voice sounding exactly like their CEO, urgently requesting that they bypass a normal approval process because of an important business issue. Thirty-five percent of senior managers said they would likely comply before independently verifying the request, compared with 23 percent of middle managers, 21 percent of junior managers, and 16 percent of clerical workers.
Meanwhile, 78 percent of senior managers felt confident distinguishing a genuine CEO message from an AI-generated one. Just 49 percent of clerical workers expressed that confidence, despite giving more cautious answers to the voice scenario.
These figures describe what respondents think they would do. Researchers did not put them through an actual deepfake detection test, so the survey cannot establish that senior managers fall for these scams at twice the rate of clerical workers.
The findings about workplace pressure are arguably more interesting. Half of respondents said challenging a senior executive’s request would feel uncomfortable, and 52 percent worried about negative consequences from questioning a senior leader. Fear of appearing disrespectful was the most commonly cited reason for hesitating, at 40 percent.
Management also seems to have a rosier view of how freely employees can speak up. Eighty-two percent of senior managers agreed that their organisation supports questioning suspicious executive requests, even urgent ones. Only 51 percent of clerical workers and 50 percent of junior managers agreed.
My take? A company can tell employees to challenge unusual instructions all day long, but that advice loses its value if the real boss gets irritated when someone asks for confirmation. Employees need to know that following the security process will not get them in trouble, even when it slows down someone important.
A separate scenario involved an urgent WhatsApp message supposedly from a travelling CEO who could not access company systems. Eight percent of respondents said they would immediately send the confidential information requested, while 16 percent would reply asking for confirmation.
That reply might feel cautious, but it leaves the same person controlling the conversation. An impersonator can simply confirm their own request, which is why checking through a separate, trusted route matters.
Training presents another awkward finding. Thirty-nine percent of senior managers reported receiving instruction specifically about AI-generated scams involving senior leaders, compared with 12 percent of clerical workers. However, the report does not compare trained and untrained respondents within each group, so those numbers cannot tell us whether the training helped.
There are limits to the broader conclusions, too. The research covers Singapore, and the published report does not disclose subgroup sample sizes or statistical significance tests. KnowBe4 sells security training and attack simulations, giving it a commercial interest in the problem it describes.
Still, the survey raises a useful challenge for employers. If your security procedures depend on workers questioning an AI-cloned executive, your workplace culture had better allow them to question the real one.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
