Synthetic Impersonation in the Power Sector

Purpose. This study examines synthetic impersonation in the power sector as a decision-security problem, focusing on the conditions under which manipulated communication may lead to unsafe operational decisions and on the organisational safeguards associated with safer behaviour. Method. An exploratory, quasi-experimental, scenario-based design was applied. The study comprised 24 attack scenarios, 24 communication stimuli, 8 operational command paths, an 8-layer security control matrix, and a supplier dependency layer. The analytical dataset contained 744 decision observations nested within 31 participants across four procedural conditions. Descriptive and comparative analyses were supplemented with participant-clustered generalized estimating equation modelling. Findings. Unsafe responses occurred in 26.34% of observations. The unsafe response rate decreased descriptively from 29.03% under Baseline conditions to 23.66% under Full Layered Control, although between-condition differences were not statistically significant. Unsafe responses were concentrated in selected high-consequence scenarios, particularly grid topology disclosure, hot-work approval, and black-start initiation. Unsafe decisions were associated with shorter decision times, whereas perceived authenticity did not meaningfully distinguish safe from unsafe outcomes. Theoretical implications. The findings support examining synthetic impersonation through a decision-security perspective that complements media-authenticity and deepfake-detection approaches by focusing on the pathway through which communication is translated into operational action. Practical implications. Power-sector organisations should prioritise high-consequence command paths, strengthen structured verification and authorisation procedures, and separate message receipt from operational execution, including in supplier-mediated communication. Originality/value. The study provides a sector-specific empirical examination of synthetic impersonation as a human-centered operational security problem and links deepfake research with decision behavior and critical-infrastructure governance. Limitations/future research. The exploratory sample and non-significant condition-level effects limit causal and population-level conclusions. Larger, preregistered, multi-organization studies are required to validate the observed patterns. Article type: Empirical research article.