Deepfakes in SEC Filings Study

Key takeaways

1. 394 10-K annual reports filed from January 1 to October 30, 2026 mention deepfakes, 7.5% of operating companies' annual reports; in 2023 there were 12, and before 2020 none. See details
2. The jump came in 2024, from 12 filings to 190, the year generative AI went from 77 10-Ks to 711 and the first season of the SEC's cybersecurity disclosure rules. The mentions sit in Risk Factors (336 of 394 in 2026), not the new Cybersecurity item (9), and 265 of the 394 also mention generative AI. See details
3. Once a company names deepfakes it keeps them: 229 of the 242 companies that mentioned deepfakes in 2025 and filed again in 2026 did so again. See details
4. Software and IT services have the highest rate (17.7% of their 10-Ks); pharmaceuticals and biotech file the most mentions (78); banks sit at 7.3%. See details
5. Most mentions are a word in a list: 84% of 2026 filings name deepfakes only among cyber threats, and 150 of 394 use a clause found word for word in another company's 10-K. 61 mention impersonation, but only 8 say who gets impersonated. See details
6. Voice cloning and synthetic media stay rare in annual reports (5 and 28 filings in 2026), while generative AI appears in 29.6%. See details

How many 10-Ks mention deepfakes?

Companies listed in the U.S. file a 10-K annual report with the SEC every year, including what could go wrong for them. We counted, for each calendar year since 2018, how many 10-K filings mention deepfakes in the report itself, using the SEC's EDGAR full-text search. 394 10-Ks filed from January 1 to October 30, 2026 did: 7.5% of the 5,285 10-Ks from operating companies, up from 275 in 2025 and 12 in 2023. None did before 2020.

The mention sticks. Of the 242 companies that named deepfakes in 2025 and filed a 10-K again in 2026, 229 named them again. 463 companies have mentioned deepfakes in at least one 10-K since 2020.

What changed in 2024?

Filings mentioning deepfakes went from 12 in 2023 to 190 in 2024. Two things arrived that year. Generative AI went from 77 10-Ks to 711. And 2024 was the first filing season in which 10-Ks had to describe how the company manages cybersecurity risk, under rules the SEC adopted in July 2023 for annual reports for fiscal years ending on or after December 15, 2023 (SEC). The deepfake mentions follow the AI vocabulary more than the new section: in the 2026 filings the first mention sits under Item 1A, Risk Factors, in 336 of 394 and under the new Item 1C, Cybersecurity, in 9, and 265 of the 394 also mention generative AI (107 of 190 in 2024). The filings cannot say which change moved each company; both point the same way.

Which industries mention deepfakes?

By rate, software and IT services: 17.7% of their 2026 10-Ks mention deepfakes. By count, pharmaceuticals and biotech lead with 78 filings, 60% of them in a clause shared word for word with another company. Banks and savings institutions are at 7.3%. Industries are grouped from each filer's SIC code; only groups with at least 100 filings are shown.

What do the 10-Ks say about deepfakes?

Mostly that they are one more tool for attackers. We pulled every sentence mentioning deepfakes from all 394 filings from 2026. 84% only list deepfakes among threats such as phishing and social engineering. 61 mention impersonation, but only 8 say who gets impersonated (executives, leaders, staff, clients or vendors). 33 describe fake customers, job applicants or identities at account opening, hiring or claims, 20 misinformation or harm to the company's reputation, 12 laws or rules about deepfakes that apply to them, and 3 sell deepfake detection or protection themselves. A filing can count under several. Labels came from keywords; on 26 filings checked by hand after the rules were written, they matched our reading on 25.

How much of it is template language?

A lot. 150 of the 394 filings from 2026 mention deepfakes in a clause that appears word for word in at least one other company's 10-K, 27 shared clauses in all. The most common, in 61 filings, reads: "…to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks),…" It explains much of the pharmaceutical and biotech count: 47 of the 78 filings from that group use a shared clause. Shared wording means the clause came from a common template or was copied, so a mention shows the risk was written into the filing, not that the company has been targeted.

Voice cloning, synthetic media and generative AI

The other vocabulary of fake media barely appears: voice cloning in 5 filings in 2026 and synthetic media in 28, often as a definition of deepfakes. Generative AI is far more common, in 29.6% of operating companies' 2026 10-Ks (1,565 filings), up from 77 in 2023.

Who mentioned deepfakes first?

Adobe in a 10-K filed January 21, 2020, then Marsh & McLennan Companies on February 20, 2020, the same two the Autonomy Institute found first among S&P 500 companies. The Autonomy Institute counted S&P 500 companies citing deepfakes as a risk going from 16 to 40 between each company's two latest 10-Ks as of May 2025; our count covers every 10-K filer.

What this means

• Deepfakes are now a standard line in the risk factors. One operating company in 13 names them, and almost none drop the line once added.
• A mention is not an incident. Template language and lists of threats make up most of it. Scanning all 394 filings from 2026 for language about attacks the company has experienced near a deepfake mention, we found 17 passages and read each: none describes a specific deepfake incident, though TJX Companies lists deepfakes among the attempts its systems face. The same holds for incident reports: of the 62 8-K filings since 2023 that mention deepfakes, none is a cybersecurity incident report (Item 1.05); 58 mention them only in an attached press release or presentation.
• Beyond the list, the worries are impersonation and fake identities. 61 filings mention impersonation and 33 fake customers, applicants or identities; few say who would be faked.

Our AI video statistics trace where common deepfake figures come from, including the claim that 90% of online content will be synthetic (traced here). Mark Studios edits corporate video for companies that put their leaders on camera.

How we ran the study

Counts. For each calendar year by filing date we queried EDGAR full-text search for 10-K filings containing each exact phrase (deepfake, deepfakes, deep fake, deep fakes; the search matches only the words as typed, EDGAR full-text search FAQ), paged through every result and counted distinct original filings (amendments excluded) whose main document contains it, so exhibits such as codes of conduct do not count. 2026 runs from January 1 to October 30.

Denominator. Every original 10-K main document in the same full-text index that year, read with an empty query, with each filer's SIC code; asset-backed securities trusts (SIC 6189), whose 10-Ks are servicing reports, are left out of the operating-company share. The EDGAR form indexes list a few percent more 10-Ks than the full-text index holds (6,423 in 2026); counted against those, the shares would be slightly lower.

What the filings say. For all 394 filings from 2026 we pulled every sentence mentioning deepfakes, the 10-K item it sits under and the 17 words around the first mention (to find clauses shared word for word). Topic labels came from keyword rules written against 60 filings we read by hand, then checked on 26 others, where they matched our reading on 25.

Limitations

• Mentions, not attacks. Most filings describe a risk, none we read describes a specific deepfake incident, and no 8-K cybersecurity incident reports since 2023 mention deepfakes.
• 10-Ks only. Foreign companies filing 20-Fs, private companies and quarterly reports are not counted.
• Exact phrases. Wording outside the list (AI-generated likenesses, face swaps) is not counted.
• Industry codes are the filer's. A company's SIC code describes its main business at registration and can be dated.

How to cite this study

Link to the section you use, for example https://www.markstudios.com/research/deepfakes-in-sec-filings-study#trend. To cite the study as a whole:

Mark Studios. "Deepfakes in SEC Filings Study." Published October 31, 2026. https://www.markstudios.com/research/deepfakes-in-sec-filings-study

@misc{markstudios_deepfakes_in_sec_filings_study_2026,
  author = {{Mark Studios}},
  title = {{Deepfakes in SEC Filings Study}},
  year = {2026},
  month = oct,
  url = {https://www.markstudios.com/research/deepfakes-in-sec-filings-study},
  note = {Last verified 2026-10-31}
}

Our counts and the CSVs are free to reuse under CC BY 4.0 with a link to this page.

Sources

Yearly counts (CSV) · Every deepfake filing (CSV) · Industries (CSV)

Widely quoted video statistics on other topics are traced to their origin, with a verdict on each, in our research fact-check.

1. U.S. Securities and Exchange Commission, EDGAR Full-Text Search. Accessed 2026-10-31.
2. U.S. Securities and Exchange Commission, EDGAR Full-Text Search FAQ. Accessed 2026-10-31.
3. U.S. Securities and Exchange Commission, EDGAR full index (quarterly form indexes). Accessed 2026-10-31.
4. U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (press release 2023-139). Accessed 2026-10-31.
5. Autonomy Institute, S&P 500's Automation Anxieties. Accessed 2026-10-31.

Update policy and change log

We plan to add each year's filings as they come in. Corrections go to contact@markstudios.com.

• October 31, 2026: First published.