Organizations Urged to Apply Zero Trust to Information as AI-Driven Misinformation Becomes Systemic Business Risk

The reality facing businesses today is stark: employees, customers, investors, and board members are already being deceived, and the deception is becoming more difficult to detect with every passing quarter. For years, security warnings have focused on the dramatic manifestations of deepfake technology — fraudulent CEOs appearing on video calls, cloned executive voices authorizing multimillion-dollar payments, and highly convincing phishing emails that bypass traditional filters. These tactics themselves are not new, but artificial intelligence has fundamentally changed the economics of deception. What once required significant technical skill, time, and resources can now be produced cheaply, at scale, and with a level of realism that makes it nearly indistinguishable from authentic communication in the ordinary flow of business. This shift has forced cybersecurity professionals to reconsider a foundational assumption: that the problem is primarily about unauthorized access to systems. In an environment where AI can generate convincing falsehoods in seconds, the principle of Zero Trust — never trust, always verify — is becoming just as relevant to how information itself is treated as it has long been to how access is granted. Zero Trust in cybersecurity starts from a simple and uncompromising premise: no user, device, application, or request should be trusted by default, regardless of whether it originates inside or outside the corporate perimeter. Now, in the age of AI-generated misinformation, organizations need to apply that same mindset to the information that moves throughout their operations, to the intent behind the actions taken on that information, and to the behaviors of the increasingly autonomous systems acting on it. Without this evolution, the damage may not come from a network breach, but from a slow erosion of the very trust that underpins commercial relationships, reputational capital, and decision-making integrity.

This new trust crisis is not merely a technical problem; it is a fundamental business risk rooted in the fact that employees, customers, investors, partners, and regulators all make decisions based on what they see, read, and hear. If that information is false, manipulated, or stripped of essential context, the consequences can move quickly from confusion to commercial damage. Security experts increasingly distinguish between three related but distinct categories of harmful content. Misinformation is false content that spreads without deliberate intent — an outdated report, a mislabeled chart, or a hallucinated AI summary that gains traction inside an organization. Disinformation is constructed specifically to deceive, and it is now easier to manufacture at scale than ever before, enabling competitors, criminal groups, or hostile nation-states to plant fabricated narratives directly into the information streams that decision-makers rely upon. Malinformation, however, may be the most insidious of the three: it is true information, often deliberately stripped of context and weaponized to damage an organization’s reputation, inflame stakeholders, or sway board decisions. The critical point is that an adversary no longer needs to breach a network, steal data, or hold systems ransom to cause serious harm. They can influence the people associated with and concerned about an organization simply by shaping what those people see, believe, and subsequently act upon. This mirrors a struggle already unfolding in everyday life, where individuals are overwhelmed by AI-generated content and must adopt defensive habits: pause before reacting, question the source, verify before acting. Businesses, however, cannot rely on awareness campaigns alone. The instinct to trust, once a social and organizational asset, has become a vulnerability. Addressing it requires a structural and systemic response, one that embeds verification and skepticism into the very workflows, approval processes, and automated systems through which information flows.

This is where Zero Trust becomes not just a security strategy, but an organizational operating principle. Traditionally, organizations have thought about Zero Trust through the lens of least privilege — ensuring that the right users have access to the right applications and nothing more. But in an AI-driven information environment, that principle must evolve. Businesses can no longer focus solely on who is requesting access to systems; they also need to interrogate what information is being used, what action is being taken based on that information, and whether the intent behind the action can be trusted. The next stage goes beyond authentication and moves into continuous investigation of authenticity. Organizations must ask: Is this information verified? Is this image real or AI-generated? Has this content been edited, and if so, by whom and with what purpose? Zero Trust provides a framework for answering those questions, forcing organizations to verify before they act, limit exposure where they can, and reduce the risk of false, manipulated, or decontextualized information moving unchecked through the business. Standards bodies such as the Coalition for Content Provenance and Authenticity (C2PA) are already pointing toward the future, where provenance and integrity are embedded in digital content itself, much like a padlock in a browser signals that a connection is secure. In that future, trust will not be something that businesses need to check for after the fact; it will travel with the information as provenance feeds seamlessly into verification systems. Every email, document, video, voice message, and analytical output becomes a signal in a continuous trust decision, and any gap in that chain represents a potential vulnerability that an adversary could exploit.

The need to trust intent has become even more pressing as AI agents enter the workplace. These agents — autonomous software systems that can read documents, interpret data, make decisions, and take actions — will increasingly operate like another person working alongside human employees, mirroring behaviors previously reserved for trusted colleagues. The difference, however, is that these non-human identities move at machine speed, where human-speed verification has no hope of keeping up. An AI agent can process thousands of documents, approve hundreds of transactions, or send a flood of communications in the time it takes a human manager to review a single request. That speed makes the governance challenge immensely more complex. AI agents must be governed through a Zero Trust model from the outset; an agent should not be trusted simply because it sits inside the enterprise, has been approved by a user, or is connected to corporate systems. Its identity, permissions, behavior, and outputs all need to be continuously validated, not just at login but at every step of operation. Just as importantly, agents should be governed by least privilege, the principle of least information, and the principle of least function — granting only the minimum access, data, and capability required for a specific task, and revoking those grants the moment they are no longer needed. However, these agents create a trust challenge that identity management alone cannot solve. Businesses will need to know whether they are dealing with a human or a machine, whether an agent is behaving responsibly, and whether its actions reflect the organization’s values, boundaries, and regulatory obligations. Effectively, this means adopting an operating constitution — a set of explicit rules, principles, and guardrails — that agents are continuously measured against, with violations flagged and remediated automatically.

In this AI era, enterprises must interrogate information, content, intent, behavior, and action in real time and continuously, because identity checks at the front door are no longer sufficient. The scale of the task is such that it will take AI itself to audit, flag, and govern the systems that rely on other AI, creating a layered defense where machine-speed monitoring is used to keep the chain of trust intact. The organizations that succeed will be those that treat trust as something to be engineered, rather than assumed. Misinformation, disinformation, and malinformation are not just IT problems; they are security challenges, resilience challenges, and leadership challenges, and AI is making them harder to ignore with each passing cycle. As technology continues to shape how information is created, shared, and acted upon, businesses need to build the same discipline around authenticity that they have always applied to access. That means verifying content at the point of use, questioning the intent behind both human and machine actions, and limiting what AI systems can do to what they actually need to do — no more, no less. It also means recognizing that human employees, who are themselves targets of manipulation, must be supported by systems that do not place the entire burden of verification on their shoulders. Automated content provenance, real-time tamper detection, behavior monitoring for AI agents, and continuous validation of data integrity all become necessary components of a modern trust infrastructure.

Trust, in short, can no longer be the default setting in today’s operating environment. Instead, it must be a decision that is made continuously, at machine speed, across information, intent, behavior, and action. The good news is that the conceptual framework already exists in Zero Trust, a model that has been tested and refined in the world of network security for years. What needs to change is how organizations apply it, broadening the scope from access control to encompass the full lifecycle of information and the full spectrum of automated action. Leaders must recognize that the same technologies that enable them to process data faster, serve customers better, and compete more effectively also enable adversaries to manipulate, deceive, and disrupt at an unprecedented scale. A competitor, a criminal group, or an activist campaign can cause serious damage without ever breaching a network, simply by shaping what an organization’s stakeholders see and believe. Every piece of content, whether an internal email, a customer communication, a supplier invoice, or an AI-generated analysis, therefore becomes a signal in a continuous trust decision. The companies that thrive in the coming years will be those that view trust not as an assumption but as a discipline — one that is engineered into their technology stack, their governance processes, and their organizational culture. They will be led by executives who treat authenticity as a board-level concern, who demand provenance from their data providers, who scrutinize the behavior of their AI agents as closely as they do their human employees, and who understand that in an age of machine-generated deception, the question is never whether something can be trusted, but how it can be verified. This article was produced as part of TechRadar Pro Perspectives, a channel featuring insights from the technology industry, and reflects the views of the author rather than those of the publication.