Sora is out: synthetic video stops being a research demo
OpenAI released its video model to subscribers on 9 December 2024. The marketing use is obvious. The verification problem is the one to plan for.
On 9 December 2024, as part of its run of daily announcements, OpenAI released Sora, its text-to-video model, to ChatGPT subscribers. Type a description or supply an image, get a short video.
It had been shown in February. Public availability is the difference that matters, because capability that anyone can use is capability that will be used against you.
The legitimate use, briefly
For a small marketing budget this is genuinely useful: product backgrounds, short social clips, visual concepts to show a client before commissioning a real shoot. A Swiss SME that could never afford a video production now has a rough draft for the price of a subscription.
Two cautions. Generated video is recognisably generated to an attentive viewer, and for a company selling precision work that can read badly. And if you publish it, say so — a customer discovering it later costs more than the production you saved.
The problem that needs a process
Video and audio have been the last informal proof of identity in business. A voice on the phone, a face on a video call: both were treated as evidence. Neither is any more.
The attack that matters for an SME is not a fake advertisement. It is a short video call, or a voice message, from someone who looks and sounds like your managing director, asking for an urgent payment or a change of bank details while they are travelling.
This is not hypothetical, and the target profile is exactly a company small enough to have no formal payment process and large enough to move meaningful sums.
The rule to write down this week
- No payment or bank-detail change is ever authorised by voice, video or email alone. Confirmation goes through a second channel the requester did not choose, to a number you already had on file.
- Say out loud that this applies to the boss. These attacks work through authority and urgency. An employee who fears looking obstructive will not verify. Remove that fear explicitly.
- Practise once. Tell the finance team a test will come at some point. Knowing it might happen changes behaviour more than any policy document.
It takes fifteen minutes and it is the highest-return security work available to a small company right now.