Looks real is not proof.
Deepfakes make sight and sound cheap to fake. Zero Trust means you stop asking whether it looks right and start asking what proves it. Try breaking a signature below.
Change one character
This message was signed with a SHA-256 fingerprint at the moment it was written. Edit the text and watch the fingerprint fail.
The text matches what was signed.
Triage desk
Describe what reached you. The desk tells you what evidence to collect before you act. It never says something is verified.
Warning signs
Three independent checks
Second factor
Not yet
This is model output, and it is unverified too. It cannot see your files, audio, or video. Use it to plan your checks, then do them.
Safe phrase
A shared secret for the people who could be impersonated to you, and the people you could be impersonated to.
Cloned voices and live video can fake a loved one in trouble. A phrase you agreed on in person cannot be scraped from a video or a post. If a panic call asks for money or urgent action, ask for it.
- Agree on it face to face or over a channel you already trust.
- Keep it unwritten. Do not text it, email it, or store it in a notes app.
- Change it after it has been used in a real challenge.
- If the caller cannot give it, hang up and call back on a number you already know.
Field guide
Zero Trust started in network security. The same rule now applies to media and to real life.
In a traditional network, anything past the firewall is treated as safe. In Zero Trust, no user, device, or request is assumed safe, even inside the perimeter. Applied to information, nothing is real just because it looks convincing, comes from an authority, or sits on a big platform.
Signed at the sensor
Cameras and phones can sign photos and video at capture using secure chips. Standards like C2PA attach a tamper-evident Content Credential. Edit or generate the file and the hash breaks. You trust the unbroken chain, not the pixels.
A second channel
If an email asks for money, you do not reply to it. You call the person on a number you already have. Do the same with information: confirm through an independent second factor before you treat it as fact.
Track provenance, not appearance
- Look for Content Credentials on news media and images. They show whether an asset was recorded, altered, or generated. No credential means unproven, not fake.
- Trace source zero. For a viral video or shocking quote, skip the commentary and find the raw, unedited original. Then judge who published it.
Challenge and response in real life
- Set an offline safe phrase with family and key colleagues, and ask for it when money or urgent action is on the line.
- Hang up and call back on a pre-verified line or an encrypted channel such as Signal. Do not continue on the incoming connection.
Triangulate before you believe
Ask for three independent vectors before accepting an event as true.
- Physical: is there cryptographically signed media from sensors on the ground?
- Institutional: are there court filings, official records, or regulatory documents attached to the claim?
- Cross-ideological: do independent, opposing observers confirm the same core facts?
Defense in depth for organizations
- Separation of duties. No single person can move money, release sensitive data, or issue official statements based only on a video call, voice message, or ordinary email.
- Strong identity checks. Require hardware keys such as FIDO2 or WebAuthn, or multi-person signatures, for critical actions.
When sight and sound are cheap to generate, "it looks real" stops being evidence. What counts is a chain of custody and independent sources that agree.