Core
Digital Executive Protection
Executive and family exposure baselining, PII reduction coordination, credential and breach exposure, impersonation risk, personal digital hardening, and continuous monitoring by scope.
Explore DEPExposure Management | Protective Intelligence
Digital Executive Protection — Built by Protective Operators.
Global Makarios identifies executive exposure, develops protective intelligence, and turns changing digital and physical risk into prioritized protective decisions and verified countermeasures.
Operator-ledThreat-drivenHuman authorityAI-enabled scale
From signal to protective action.
01Exposure & IntelligenceIdentify
02Threat AssessmentAssess
03CountermeasureSelect
04Budget & OwnerAssign
05Readiness & VerificationVerify
06ReassessmentAdapt
◆Digital Executive Protection
◆Protective Intelligence
◆Threat & Risk Assessment
◆Protective Operations
The protection chain
Exposure is not the end product.
Finding exposed data or generating an alert is only useful if it changes the protective posture. Global Makarios connects intelligence to action.
Public Exposure
PII, credentials, patterns, identity and digital footprint.
Targeting
How exposure can be operationalized against the principal.
Threat
Intent, capability, vulnerability, consequence and confidence.
Assessment
What changed, why it matters, and what requires action.
Countermeasure
Specific action, cost, owner, timing and alternatives.
Continuous Review
Verification, monitoring, reassessment and institutional learning.
The operational void
There is no value in a threat assessment that cannot tell you what to do next.
Threat-led budgets.
Protective spending should be tied to a named threat, vulnerability, exposure, or mission condition—not generic fear or an equipment catalog.
Countermeasure mechanics.
Every material finding should drive a specific protective action, owner, readiness standard, and verification step.
Digital-to-physical continuity.
Personal data, impersonation, social signals, travel, residences, movement, vendors, communications, and emergency readiness belong in one protective picture.
Capabilities
One protective picture. Multiple disciplines.
Managed services and specialized projects are built around the principal, mission, and current threat posture—not a fixed technology stack.
Core
Protective Intelligence
Living threat assessment, persons-of-concern development, social-media triage, travel and event intelligence, escalation protocols, and decision briefs.
Explore Protective IntelligenceAssessment
Threat, Vulnerability & Site Assessment
Threat-led evaluation of physical security, access control, routines, people, technology, and emergency readiness with prioritized countermeasures.
Explore AssessmentsOperations
Executive Protection & GSOC Concepts
Program design, advance and site work, movement, residential posture, communications, liaison, GSOC/EOC concepts, and qualified field execution where required.
Explore OperationsMobility
Travel Risk Management
Destination and route intelligence, transportation/provider vetting, itinerary exposure, communications, medical contingencies, local liaison, and post-travel lessons.
Explore TRMSpecialized
Due Diligence & Protective Readiness
Decision-grade meeting, counterparty, vendor, investment, and relationship diligence; EAP and protective medical-readiness planning; explicit disposition and controls.
Explore Due DiligenceFrom concern to a scoped engagement
Know what needs protection.
Know what happens next.
Global Makarios helps executive offices, family offices and security leaders connect digital exposure, protective intelligence and operational planning. Start with the decision your team must make—not a list of disconnected alerts.
Executive and family exposure review
Understand how public information, online identities and daily patterns can create exposure around a principal. Build a prioritized picture of what warrants attention and which issues call for technical, administrative or protective action.
Discuss: the principal’s exposure baseline, priority concerns and a practical remediation plan.
Explore Digital Executive Protection →Threat assessment and intelligence support
Give a concerning development the context it needs. Separate established facts from unresolved questions, assess the relevance to the mission and identify decisions that should change the protective posture.
Discuss: an assessed concern, escalation criteria, countermeasure priorities and reassessment triggers.
Explore threat assessment →Travel and protective readiness
Connect destination conditions, itinerary requirements and operational dependencies before movement begins. Make contingencies, communications and responsibilities part of the planning conversation.
Discuss: a travel intelligence brief, planning priorities and readiness requirements for your mission.
Explore travel risk management →Give leadership a decision it can act on.
A useful engagement should define the issue, its operational relevance, the action recommended and the person responsible for carrying it forward. Global Makarios builds the conversation around those outputs so the scope, priorities and expected deliverables are understood before work begins.
Support can be scoped around a specific concern, an assessment, a travel requirement or a continuing protective need. The consultation establishes fit, information requirements and next steps; it is not a request to place sensitive case details into a public form.
Request a confidential consultationDecision-grade reporting
Information should end in a decision.
Global Makarios reporting is designed to move from verified information to an operational disposition—not stop at a data dump.
01
FactsWhat is verified, reported, unresolved, or hypothesized?
02
AssessmentWhat does the information mean in the current protective context?
03
DispositionProceed, restrict, monitor, escalate, defer, or investigate further.
04
CountermeasureWhat action reduces the identified exposure or risk?
05
Owner & ReviewWho owns the action, how is it verified, and when is it reassessed?
Project Sable · Deepfake fraud case study
When the face and voice you trust
become the attack.
An earlier fraud case with lasting implications for executive protection. Watch Project Sable, then examine the real financial impact and the ways this threat has expanded.
The real case behind the film · 2024
One convincing meeting. Millions transferred.
In January 2024, an Arup employee in Hong Kong was deceived by a video conference impersonating company executives. The employee made 15 transfers to five bank accounts, totaling HK$200 million—approximately US$25.6 million. Arup confirmed that fake voices and images were used. The Financial Times reported the company’s identity in May 2024.
The deception attacked the employee’s basis for trusting an instruction. What appeared to be familiar leadership and corroborating colleagues made an extraordinary financial request look legitimate. Project Sable dramatizes that failure of verification through a fictional company; its scenes and conversations should not be treated as a reconstruction of the actual meeting.
£25.4 million
The impact went beyond the initial transfers.
In its December 2024 financial announcement, Arup reported that the fraud incident and associated costs totaled £25.4 million. This is a separate reported measure, not a currency conversion of the HK$200 million transferred. Arup also stated that project delivery continued uninterrupted and its operations and financial stability were unaffected.
Why the implications reach the executive office
Global Makarios assessment
A convincing impersonation can exploit authority, confidentiality and time pressure at once. Finance, an executive assistant, a family office or a protective team may each receive an instruction that appears to originate from someone they know. If recognition substitutes for independent authorization, a trusted employee can become the route through which the organization’s own processes are used against it.
The wider business exposure includes interrupted decision-making, investigation and response costs, diverted leadership attention, sensitive information disclosure and loss of confidence in executive communications. These are risk implications for organizations assessing this threat—not additional claims about what happened inside Arup. A robust response must protect both the person being impersonated and the people expected to act on that person’s instructions.
Case sources: Financial Times, “Arup lost $25mn in Hong Kong deepfake video conference scam,” 16 May 2024; Arup, “Arup records revenue of £2.2bn for 23/24 financial year,” updated 29 December 2024. Full source references appear below.
Beyond the 2024 case
How the threat has expanded
The danger is broader than a more convincing face. Subsequent FBI reporting documents synthetic media being combined with other methods to obtain money, information and access. These developments extend the threat; they do not mean every technique began after 2024.
Video impersonation during an interaction
The FBI’s December 2024 warning described AI-generated video used in real-time chats impersonating executives and other authority figures. The exposure extends to interactions that appear responsive and credible, not merely prerecorded messages.
FBI IC3 · 3 December 2024A coordinated identity across formats
The same FBI warning described synthetic text, images, identification documents, audio and video supporting fraud. Multiple messages or apparent proofs can reinforce one invented identity; agreement among them does not establish independent confirmation.
FBI IC3 · 3 December 2024Relationships and encrypted messaging
In December 2025, the FBI described officials being impersonated through texts and AI-generated voice messages, with conversations moved to encrypted applications. Requests included funds, personal documents and authentication codes. Encryption protects a communication channel; it does not independently prove who is behind an apparent identity.
FBI IC3 · 19 December 2025Identity fraud at the point of hiring
The FBI reported AI and face-swapping in video interviews involving North Korean IT workers. This expands the protective concern from a single fraudulent instruction to who receives a role, access and continuing trust inside an organization.
FBI · 23 January 2025Impersonating the people offering help
In July 2026, the FBI warned of AI-generated videos depicting a senior FBI leader and directing victims toward a spoofed IC3 complaint site. Even an apparent recovery or reporting channel can become another attempt to obtain sensitive information.
FBI IC3 · 20 July 2026Recognition is no longer sufficient authority.
A familiar face, matching voice, plausible message and recognizable application may all appear together. Together, those cues can lend apparent authority to a fraudulent instruction and place consequential business decisions at risk.
Global Makarios assessmentOpen the dedicated Project Sable video page →
Case and threat-development source references
References are displayed for attribution. This section contains no report download buttons or outbound report links.
- Financial Times · 16 May 2024 · Arup lost $25mn in Hong Kong deepfake video conference scam.ft.com/content/b977e8d4-664c-4ae4-8a8e-eb93bdf785ea
- Arup · Updated 29 December 2024 · Arup records revenue of £2.2bn for 23/24 financial year.arup.com/news/december-2024-arup-records-revenue-of-2.2bn-for-2324-financial-year/
- FBI IC3 · 3 December 2024 · Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud.ic3.gov/PSA/2024/PSA241203
- FBI · 23 January 2025 · North Korean IT Workers Conducting Data Extortion.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-workers-conducting-data-extortion
- FBI IC3 · 19 December 2025 · Senior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign.ic3.gov/PSA/2025/PSA251219
- FBI IC3 · 20 July 2026 · FBI Warns of Scammers Impersonating the IC3.ic3.gov/PSA/2026/PSA260720
The broader synthetic-media threat
The FBI figures below cover AI-related complaints across fraud types; they are not totals for video deepfakes alone.
Nearly $893M
Adjusted losses tied to those AI-related complaints.
The FBI cites fake profiles, voice clones, IDs, and believable videos among tactics.No single solution.
FTC analysis emphasizes prevention/authentication, real-time detection, and post-use evaluation.
View FTC source ↗Operator-built AI
AI should compress time—not replace judgment.
The same operator who owns the protective doctrine should shape the AI workflow. That closes the gap created when security expertise is translated by a separate technical team that does not own the mission.
FACTS
ASSESSMENT
DISPOSITION
COUNTERMEASURE
OWNER
NEXT REVIEW
Human authority. Agentic support.
Specialized AI workflows can support collection, source correlation, change detection, entity resolution, travel intelligence, social triage, case tagging, documentation, task routing, and institutional knowledge.
Consequential protective decisions remain human-led.
Upcoming rollout · Platforms in development
Purpose-built platforms.
Across the protection mission.
Global Makarios is developing a full family of AI-enabled platforms for the executive protection ecosystem and the operational infrastructure on which it depends. Nine planned verticals address distinct responsibilities—from understanding executive exposure to coordinating a crisis response.
Development preview. Availability, release order and launch dates will be announced as each capability is ready.
Digital Executive Protection
For executive offices, family offices and corporate security
Bring personal exposure, impersonation concerns and executive digital risk into a protection workflow. Planned workspaces will help teams prioritize what matters to the principal and coordinate remediation with the right owner.
Planned focus: Exposure priorities, remediation tracking and executive briefings.
Protective Intelligence
For analysts and protective operations leaders
Move from a stream of information to an assessed concern. Planned workflows will organize source context, relevance, confidence and escalation so that analysts can explain why a development matters and what requires attention.
Planned focus: Assessment records, escalation decisions and operational intelligence briefs.
Threat and Vulnerability Assessment
For security directors and risk owners
Connect a defined threat to the people, places and processes it could affect. The planned vertical will support structured assessments, defensible prioritization and countermeasure follow-through.
Planned focus: Risk registers, countermeasure ownership and reassessment records.
Executive Protection Operations
For detail leaders and protection teams
Give protective teams a practical way to prepare, brief, coordinate and review a mission. The product direction centers on clear responsibilities and timely operational context, with human authority over protective decisions.
Planned focus: Mission preparation, team tasking and after-action follow-through.
Travel Risk Management
For travel managers and protective teams
Keep the journey connected to the threat picture. Planned capabilities will bring destination context, itinerary changes, movement considerations and contingency planning into the preparation and review process.
Planned focus: Travel briefs, contingency requirements and changes requiring review.
Enterprise Risk Management
For enterprise security and business leadership
Translate protective concerns into business decisions about continuity, investment and accountability. The planned workspace will help connect operational risk with accountable owners and leadership review.
Planned focus: Decision records, treatment priorities and management reporting.
Major Events and Special Events
For event security and venue stakeholders
Organize advance planning around the actual event, stakeholders and operating conditions. Planned workflows will support responsibility assignments, coordination checkpoints and documented readiness decisions.
Planned focus: Advance requirements, stakeholder responsibilities and event readiness reviews.
Emergency Action Planning
For emergency planners and cross-functional committees
Keep response plans usable and responsibilities understood before an emergency. The planned vertical includes support for Emergency Action Planning Committee review, exercises and corrective-action ownership.
Planned focus: Role-based plans, exercise findings and improvement tracking.
GSOC and Crisis Coordination
For security operations centers and crisis leaders
Carry relevant information from initial concern through escalation, response and handover. The planned direction emphasizes shared context, clear disposition and continuity between operational shifts.
Planned focus: Incident context, escalation records and coordinated handovers.
Protection depends on the systems around it.
Intelligence informs an assessment. An assessment changes a travel or event plan. Communications carry that decision to the people responsible. Identity and access controls protect who can see information and authorize action. Resilient infrastructure helps teams maintain continuity when conditions deteriorate.
Each vertical has a distinct mission. Our product direction is to support the handoffs between those missions so that relevant context, responsibility and lessons learned can carry forward.
Specialized capabilities. Clear operational ownership. A more coordinated protective response.Discuss your operational priorities with Global Makarios and help define the capabilities your team needs next.
Discuss the upcoming platformsGovernment findings · Weekly protective intelligence
Evidence behind the mission.
Ten substantive briefings connect documented failures and emerging deception methods to the decisions a protective team must make. Explore the Butler reviews, later government oversight and three selections from our weekly intelligence reporting.
The common issue is what happens between information and action.
Butler’s July 13, 2024 assassination attempt exposed the consequences of failures in planning, coordination and communication. Digital impersonation creates a different threat, but it also tests whether relevant information reaches the right person before a consequential action occurs. These are distinct risks that require coordinated protective disciplines.
Each briefing explains the source’s scope and findings, followed by Global Makarios analysis and practical priorities. Four principal Butler review efforts—House, Senate, DHS independent panel and Secret Service—are presented alongside subsequent GAO and inspector general reporting. Weekly selections come from our October 8 intelligence document, with a reporting cutoff of October 2, 2026.
Slow scroll · Hover, focus or touch to read at your pace
September 3, 2026
Secret Service protection policies must keep pace with the threat
What the report examines
GAO-26-108455 reviews protection policy oversight and compares federal protective responsibilities. Its significance extends beyond one event to how an organization learns from incidents.
Reported findings
- GAO identified 83 security incidents in fiscal years 2015–2025; protection policies changed in response to 25.
- Eight of 22 policies were overdue for review or update. Decisions not to revise policy lacked a required documented rationale.
- Four recommendations address review accountability, decision records and an outdated Secret Service–State Department agreement.
Global Makarios assessment
The issue for a protection program is whether experience changes the next mission. A near miss can generate a meeting and a written report without changing a briefing, an assignment or a rehearsed response. Leadership needs to see which lesson became an operational requirement, who implemented it and whether it works under realistic conditions. The incident totals do not mean every event required a policy change.
Operational priorities
- Give every material finding a disposition: change a control, investigate further or document why the existing control remains appropriate.
- Assign an owner and a review date; link the decision to the relevant advance checklist, training requirement or partner agreement.
- Verify closure through an exercise, observation or other evidence, and reopen the issue when conditions change.
Leadership question: Can your team show what changed after its last significant incident—and who verified the change?
Source: GAO-26-108455, Highlights and Recommendations for Executive Action. files.gao.gov/reports/GAO-26-108455/index.html
Adopted December 5; released December 10, 2024
Butler revealed failures across the entire protective operation
What the report examines
The final House investigation covers Butler and the subsequent West Palm Beach incident, with 37 recommendations. It organizes Butler’s failures around planning, execution and leadership.
Reported findings
- Planning findings include the unsecured AGR complex, sightlines, resources, threat-information sharing and counter-drone readiness.
- Execution findings address fragmented communications, separate command posts and missed opportunities to intervene.
- Leadership findings include training gaps and unclear responsibilities.
Global Makarios assessment
For executive protection and major events, a venue plan cannot be treated as a collection of independent assignments. The vulnerability between assignments can be as consequential as a weakness within one post. A complete advance should connect the assessed threat, surrounding environment, protective resources, partner responsibilities and the decision to proceed. A map with colored boundaries is not evidence that every critical responsibility has an owner.
Operational priorities
- Review the operating environment beyond the ticketed or contracted footprint and record which organization owns each relevant concern.
- Reconcile the plans of the detail, venue, local partners and response functions before the principal arrives.
- Require unresolved issues to reach a named decision maker; record the compensating measure or the reason the mission must change.
Leadership question: Where could two participating organizations each believe the other is responsible?
Source: House Task Force, Final Report of Findings and Recommendations, December 2024; Butler security failures and recommendations, report pages 48–113. taskforce.house.gov
Interim report September 2024; chairman’s final report July 13, 2025
A warning has value only when it reaches someone able to act
What the report examines
The joint bipartisan inquiry produced an interim report. Chairman Rand Paul’s later final report drew on 17 interviews and more than 75,000 pages of records.
Reported findings
- The chairman’s findings identify denied resources, unclear advance responsibilities and poor coordination with state and local partners.
- Pertinent intelligence did not reach agents responsible for site security.
- Information about the suspicious individual was not communicated to the shift detail that could have kept Trump offstage.
Global Makarios assessment
Protective intelligence must travel all the way to an operational decision. An analyst, command post or liaison receiving information does not establish that the person controlling movement has received and understood it. Executive offices and protective teams need a common understanding of what requires immediate attention, which facts are still uncertain and who may change the plan. That understanding should survive a busy radio channel or a change of shift.
Operational priorities
- Define escalation thresholds around potential consequences to the principal rather than around which team first receives the information.
- Require acknowledgment for critical warnings and a fallback route when the intended recipient cannot be reached.
- Exercise the decision pathway from initial observation through assessment, command notification and operational disposition.
Leadership question: Who can hold or change a movement, and how does an urgent concern reach that person?
Source: Senate HSGAC, chairman’s final-report release and findings, July 13, 2025. hsgac.senate.gov
Report dated October 15, 2024; publicly released October 17
Correct the organizational conditions that allow operational failures
What the report examines
The independent panel examined both the immediate breakdowns at Butler and deeper institutional problems. Its remit was to recommend changes that would reduce the risk of recurrence.
Reported findings
- The panel described an organization that had become bureaucratic and insufficiently adaptive to changing threats.
- Its examination covered operational responsibility, communication and the protective mission.
- The panel called for fundamental reform rather than treating individual mistakes as the complete explanation.
Global Makarios assessment
A protective program can have experienced personnel and still allow weak assumptions to become routine. Readiness requires a working environment in which concerns are raised, evaluated and resolved before they become emergencies. Resources matter, but leadership also needs to know whether staff understand the mission, whether assignments fit their preparation and whether previous lessons are reaching the people doing the work.
Operational priorities
- Use readiness reviews to surface unresolved dependencies and conflicting assumptions, with a clear route for escalation.
- Evaluate exercises for decision quality, coordination and follow-through rather than attendance alone.
- Make recurring deficiencies visible to leadership and track whether corrective work changes actual practice.
Leadership question: What mechanism allows a team member to challenge an unsafe assumption before the operation starts?
Source: Independent Review Panel Final Report, October 2024. Government archive: govinfo.gov/app/details/GOVPUB-HS9-PURL-gpo233974
Public review summary and House response November 1, 2024
An internal review must lead to demonstrable operational improvement
What the report examines
The Mission Assurance Inquiry public summary addresses security failures and the agency’s response at Butler. The House task force’s public response provides an additional accountability perspective.
Reported findings
- The House said the agency’s review aligned with its own investigation of July 13 security failures.
- It acknowledged proposed improvements while calling for additional accountability and measures against recurrence.
- The review’s stated focus was the security failure, rather than resolving every question about the shooter.
Global Makarios assessment
The practical question after a review is what a protective team will do differently on its next assignment. A revised policy is only one stage of that work. The people responsible must understand the change, have the resources to carry it out and demonstrate the intended behavior. This distinction is especially important where a fix crosses organizational boundaries or depends on an outside partner.
Operational priorities
- Translate findings into specific tasks with an accountable owner, dependencies and evidence needed for closure.
- Connect approved changes to briefings, operating procedures and exercises that reach the affected personnel.
- Test the corrective action under realistic conditions and retain unresolved risk for leadership review instead of marking it complete administratively.
Leadership question: Is a corrective action considered complete when it is written, or when its effectiveness has been demonstrated?
Source: Mission Assurance Inquiry public summary; House Task Force statement on the Secret Service Mission Assurance Review, November 1, 2024. taskforce-kelly.house.gov
July 12, 2025
Threat knowledge must influence site preparation and resource decisions
What the report examines
The publicly released Butler review examined policy gaps in intelligence sharing and protective planning. Chairman Grassley’s release describes eight GAO recommendations.
Reported findings
- Senior officials received threat intelligence ten days before Butler that did not reach personnel securing the event.
- The release describes a missing process for sharing classified threat information not judged imminent.
- Other findings concern resource allocation, training and communication readiness.
Global Makarios assessment
Different parts of a protective organization can make individually reasonable decisions from an incomplete picture. The people allocating assets may not see the concern driving a request; the people planning an event may not know why additional protection is warranted. A useful risk process must preserve the operational significance of sensitive information while respecting how that information is handled. Availability alone is an incomplete basis for deciding what protection is sufficient.
Operational priorities
- Make resource requests explain the mission requirement and the risk the requested capability is intended to address.
- Record how unavailable resources affect the plan and who accepts the remaining risk or authorizes an alternative.
- Establish a route for communicating actionable protective requirements to the people who need them, including appropriate partner organizations.
Leadership question: Could your site plan and resource allocation be based on materially different threat pictures?
Source: Grassley release, GAO USSS report and eight recommendations, July 12, 2025. grassley.senate.gov
Reuters coverage July 2, 2026
Separate communications can leave the protection team without the warning
What the report examines
Later inspector general reporting adds a specific measure of the information-sharing breakdown at Butler. This entry attributes the finding to Reuters’ coverage of the government report.
Reported findings
- Reuters reported that the Secret Service did not receive 102 local radio transmissions concerning the gunman.
- Its reporting identified the absence of a joint communications room with local law enforcement as a central problem.
Global Makarios assessment
More radios and more personnel do not by themselves produce a shared operational picture. A warning may exist within one organization while the team responsible for the principal remains unaware. Communications planning should identify who monitors each input, how an urgent report crosses organizational boundaries and how receipt is confirmed. The quality of that transfer matters more than the fact that equipment is present.
Operational priorities
- Test the actual communications arrangement with the organizations assigned to the mission, including degraded or congested conditions.
- Assign responsibility for monitoring, relaying, acknowledging and escalating critical information.
- Rehearse what happens when the primary route fails, and confirm that incoming personnel understand the arrangement at handover.
Leadership question: Can a local partner’s urgent observation reach the protective decision maker without relying on an improvised phone call?
Source: Reuters, Watchdog faults Secret Service for missing 102 radio calls during 2024 Trump shooting, July 2, 2026. Secondary coverage of DHS inspector general findings.
October 1, 2026
A credible professional introduction can become an account-compromise pathway
What the report examines
Our October 8 intelligence document includes Proofpoint’s research on TA419 activity targeting AI-policy experts. This is reporting about identity impersonation and credential phishing, not evidence that every approach used synthetic video.
Reported findings
- Proofpoint describes impersonation of real experts and apparently benign outreach to build rapport.
- Follow-up material led targets to a proxied cloud sign-in experience.
- Successful password and MFA checks could still leave the attacker with the authenticated session.
Global Makarios assessment
The protective perimeter includes the executive’s professional relationships and the staff who manage invitations, documents and calendars. A plausible invitation can reach a person who has little reason to expect an attack. Once an account is compromised, the concern extends beyond that account’s inbox to the information and relationships accessible through it. Our weekly assessment emphasizes that confidence in a person’s name must be separated from verification of a particular approach.
Operational priorities
- Independently confirm unexpected professional invitations or sensitive document requests through an established contact route.
- Prioritize phishing-resistant authentication for executive, assistant, legal, finance and protective-operation accounts.
- If compromise is suspected, address active sessions and connected access as well as the password; assess whether principal-related information was exposed.
Leadership question: Does your response stop at a password reset, or does it verify that unauthorized access has ended?
Source: Proofpoint, Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles, October 1, 2026. Selected in Global Makarios weekly reporting through October 2.
September 29, 2026
A synthetic face is one component of a larger trust-manufacturing process
What the report examines
Our weekly intelligence document includes Recorded Future’s analysis of social engineering involving synthetic media. The report connects AI-enabled research and persuasive content with fabricated identity and exploitation of personal information.
Reported findings
- The analysis considers target research, lure generation, identity fabrication and sorting of exposed personal information.
- Synthetic audio or video can reinforce other apparently credible identity cues.
- The weekly assessment emphasizes independent verification and additional approval for consequential requests.
Global Makarios assessment
A caller can appear convincing because several details agree: the name, the voice, the company, the meeting context and information about the recipient. Those details are not necessarily independent evidence. A coordinated impersonation can supply them together. For an executive office, the relevant risk is the action that apparent credibility authorizes: disclosing an itinerary, changing a payment, granting access or redirecting movement. The recipient needs a reliable process that does not depend on spotting a visual defect.
Operational priorities
- Define which requests require independent verification before money, information, access or movement is affected.
- Give assistants, household staff and trusted vendors a usable escalation route when a familiar person makes an unusual request.
- Exercise plausible voice and video scenarios, and evaluate whether the established approval process survives urgency and apparent authority.
Leadership question: If every visible identity cue came from the same impersonator, what independent check would remain?
Source: Recorded Future, Social Engineering in the Age of Synthetic Media, September 29, 2026; summarized in Global Makarios Current Intelligence Document, October 8, reporting cutoff October 2.
September 29, 2026
Confirm who initiated the request—not merely whether the person exists
What the report examines
The FBI warning describes fraudsters posing as federal agents. It is an authority-impersonation case, including a staged virtual-office setting; that setting alone is not proof of AI-generated video.
Reported findings
- Scammers used real agents’ names and spoofed field-office telephone numbers.
- Confirming an agent’s employment could falsely reassure a victim about the fraudulent contact.
- One impersonator staged an online meeting to resemble an FBI office.
Global Makarios assessment
A verification step can fail even when the answer it produces is true. The named employee may exist, the organization may be real and its telephone number may be genuine, while the specific request remains fraudulent. Our weekly report therefore treats contact provenance—the origin of the actual approach—as a separate question. For high-profile principals, the same distinction matters when requests appear to come from counsel, financial institutions, law enforcement or trusted service providers.
Operational priorities
- Obtain the organization’s contact details independently and ask whether it initiated the specific outreach or request.
- Keep sensitive disclosures and financial or access decisions on hold while the origin and authority of the request are resolved.
- Preserve relevant communication details and escalate suspected impersonation through the organization’s established response process.
Leadership question: Does your callback confirm the person’s employment, or that the person actually contacted you?
Source: FBI Newark, FBI Newark Issues Warning About Insidious New Twist on an Old Fraud Scheme, September 29, 2026. Selected in Global Makarios weekly reporting through October 2.
Publisher findings and Global Makarios assessments are identified separately. Summaries are presented for on-page reading; source documents are not hosted here. Source references do not imply endorsement.
Leadership
Protective experience translated into scalable systems.
Global Makarios combines career protective and investigative tradecraft with AI, automation, and commercial systems designed to scale without severing the operator from the decision.
RH
Richard Higbie
Protective Operations | Protective Intelligence | Threat & Risk
More than three decades across law enforcement, U.S. Department of State Diplomatic Security, investigations, executive protection, protective intelligence, major-event security, crisis planning, electronic crimes, travel risk, and private-sector security leadership.
Global Makarios translates that institutional knowledge into repeatable protective doctrine, decision-grade reporting, and AI-enabled operating workflows.
Leadership profile →LC
Lawrence Cross, PhD/MBA
Artificial Intelligence | Systems Architecture | Infrastructure
Lawrence Cross brings more than 20 years of experience spanning artificial intelligence, cloud computing, networking, and the integration of complex technology platforms. His background includes Cisco and Calix, with a focus on systems design and network management.
His technical experience complements Global Makarios’ operator-led approach to a connected family of protective platforms.
Leadership profile →Controlled access
Request a confidential consultation.
Consultations begin through a controlled request process rather than open scheduling. Requests are reviewed first; approved prospects receive private scheduling instructions.
Do not submit sensitive operational details.
Do not include home addresses, itineraries, medical information, credentials, active-threat specifics, or other sensitive personal data in this public form. We will establish an appropriate channel after qualification.
Prefer email? info@globalmakarios.com