A fake statement goes viral and the first hour is measured in seconds. At VERGE: Comprehensive Security, Philip Hilm of Witnis and Patrik Slettman of TRUE Original argued that the answer isn’t to be faster than the fake, but to make the fake irrelevant.

It’s a bad day in Sweden. A fake statement from a government agency is going viral. What happens in the first hour?

We don’t have to imagine it, said Philip Hilm. It has already happened, many times. In the private sector there are cases where a single forged announcement sent a company’s share price into free fall. The first hour isn’t an hour. It’s minutes, sometimes seconds.

The conversation on Trust Infrastructure was about a different way to respond.

A new default: verify before you trust

Not long ago, we could assume that what we read, saw or received was what it claimed to be. That time is over.

Patrik Slettman put it plainly. If content can’t be verified as genuine, we should assume it isn’t. That sounds like a radical standard, but according to both speakers we are already there. Everyone in the room has probably shared something they believed was real.

AI makes the problem bigger. Agents can produce fake documents, statements and messages faster than any team can check them.

Stop competing on speed

The traditional response to disinformation is a race. A fake appears, and the organisation tries to spot it, deny it and correct it as fast as it can.

Philip’s argument is that this race can’t be won. Against AI that generates fakes at scale, you will always be fighting uphill. So change the rules instead.

If every genuine message carries proof of where it came from, and that proof is built into the systems people and AI agents already use, then anything without proof is automatically suspect. You no longer need to chase every fake. You may not need to react at all.

That includes silence. When an organisation’s channels are verifiable, the absence of a verified message is also information. If it didn’t come from us in a way you can check, we didn’t say it.

Not the truth police

Both speakers were careful about one distinction. Verification doesn’t decide what is true. It shows what the source actually said.

“We’re not the truth police,” said Philip. Everyone is responsible for their own communication.

That is deliberate. If a verification provider started deciding what is true, it would be exposed to pressure from every direction: markets, governments, foreign interests. By staying out of that equation, there is no conflict of interest.

In practice, the issuing organisation takes full responsibility for what it publishes. The technology guarantees that nothing has been changed since.

Why blockchain, here

Blockchain is often a solution looking for a problem. Both speakers gave a concrete reason for using it.

For TRUE Original, it is what made a small company trustworthy. No large institution would have trusted a two-person start-up to vouch for their certificates. Public, transparent infrastructure meant they didn’t have to.

For Witnis, it is about removing themselves from the picture. The proof is public and tamper-proof. It stays out of the user’s way, but is always available.

Philip also pointed to the EU’s eIDAS framework and its qualified trust service providers as part of what makes this hold up in the public sector, where Witnis is already live with a major Swedish organisation.

What changes in practice

TRUE Original has issued close to a million verifiable documents for more than 200 organisations in ten countries. Patrik shared what happened at an education provider issuing verifiable certificates.

Healthcare is short of staff, which makes fake nursing credentials both tempting and easy to produce. After the provider announced it was using verifiable documents, the number of calls and emails from employers trying to check certificates dropped. The students benefited too: proving a qualification became effortless.

The same pattern shows up with luxury watches. Simply announcing verification makes the number of fakes go down.

Where to start

Patrik’s advice is to start with documents. Everyone has a relationship to them, everyone has lost one, and the difference between a PDF and a verifiable document is easy to understand once you’ve seen it.

Philip’s advice is to think about impact, not volume. You may not publish much. But what would happen if a forged statement in your name appeared tomorrow morning? Seen that way, verification is a cheap insurance policy.

Whatever you choose, it has to be easy and built in. Not an extra step for users.

What to do on Monday

• Identify the one document or channel that would do the most damage if it were forged.
• Ask your communications team what happens if a fake press release in your name goes out at 7am.
• Test verifiable documents on a small scale before the end of the year.
• Treat unverified content, internal and external, as exactly that: unverified.

About the speakers

• Philip Hilm is part of Witnis, which lets anyone check whether a text is what an institution actually published.
• Patrik Slettman is co-founder of TRUE Original, which issues verifiable documents for universities, companies and other organisations.

This article is part of VERGE Pulse, a series of insights from VERGE: Comprehensive Security at Epicenter Stockholm on 19 October 2026. VERGE is Epicenter’s flagship event series, bringing founders, leaders, investors and experts into one room to explore the questions that will shape the next decade.

Want to talk about resilience in your own organisation, or shape the next VERGE with us? Get in touch with the Epicenter team.