For CFOs, this is no longer a back-office IT issue; it is a balance, liquidity, and exposure risk.

“We’re in the midst of annual planning cycles and insurance renewals, making this a critical window for CFOs to reassess vendor cyber resilience and adequate coverage,” Joy Mbanugo, CFO of CXApp Inc., a workplace experience and employee engagement platform, told me. “Investing in cybersecurity is no longer a nice-to-have; it’s a must, alongside investing in AI, given the geopolitical landscape we operate in today.”

CXApp treats vendor cyber risk as a material business risk, integrating resilience assessments into its framework, updating incident playbooks, and aligning insurance coverage with vendor exposure, according to Mbanugo. “It is important to protect sensitive data and maintain stakeholder trust, which means moving from reactive incident response to proactive risk assessment with the same rigor we apply to any material risk on the balance sheet,” he said.

But the issue goes beyond any geopolitical flashpoint. J. Michael Daniel, president and CEO of the Cyber ​​​​Threat Alliance, told me that CFOs must continue to be diligent in cybersecurity regardless of the opportunity. Daniel joined CTA in 2017, after serving as the White House’s cybersecurity coordinator. Prior to that, he spent 17 years in administration in senior roles in the Office of Management and Budget.

“The threat landscape continues to evolve,” he said. Financial institutions, because that’s where the money is, “are always in the crosshairs,” he said.

That continued risk, he argued, required more clear communication at the top. Daniel draws a comparison between how a CFO communicates with the board and how cybersecurity leaders do.

The board isn’t interested in every detail of “how do we calculate depreciation on four properties in Indiana?” he said.

Instead, they want the big picture: “Has the CFO done a good job of managing financial risk? And can the CFO explain, in plain English, how they manage financial risk for the company?”

The same should be true from a security perspective, Daniel said. Chief security officers, CISOs, and CIOs must clearly explain what they do, where they invest, how they shift risk through cyber insurance, and what risks they choose to accept—and whether that approach evolves as threats change.

However, even the best board-level strategy cannot prevent every incident. Large-scale attacks are a concern, but so are employee-targeted phishing and other social engineering attacks, which often serve as entry points.

“The truth is the things that cybersecurity professionals usually tell you to do are not rocket science,” he said. “It’s like your grandmother used to tell you: If it sounds too good to be true, it probably is,” he said.

Enemies play on emotions and create urgency, Daniel said. If a message feels rushed, check it again.

Part of the CTA’s recommendations is a campaign called “Take Nine.” The idea is simple: take nine seconds before you answer, says Daniel.

Then verify the request through another channel—whether it’s from email, text or call; if by text, send an email. That stopping and cross-checking is one of the best ways to reduce the risk that a social engineering attempt will succeed, he said.

In this environment, it seems that CFOs would do best to treat cybersecurity as a core risk discipline, and not a technical footnote.

cheryl Estrada
[email protected]

LeaderBoard-

Kenneth (Ken) Sharp appointed SVP and CFO of L3Harris Technologies (NYSE: LHX), a defense contractor, effective March 16. Sharp, 55, brings more than 30 years of defense financial and technology leadership. He succeeds Ken Bedingfield, who will focus on leading the Missile Solutions segment as its president. Sharp joins L3Harris from Peraton Inc., where he served as EVP and CFO. Prior to that, Sharp was CFO of DXC Technology, and CFO of Northrop Grumman’s Defense Systems business.

Brad Hill appointed CFO and EVP of transformation of Red Lobsterthe seafood restaurant brand. Hill will lead Red Lobster’s financial organization, along with leading the company’s strategic real estate efforts. He previously held several executive roles at PF Chang’s. Hill replaces Bob Baker, who left the company.

Great Deal

E*TRADE clients from Morgan Stanley were net buyers in five of 11 sectors in February, with a good portion of the buying occurring in areas of the market that sold off amid concerns over AI disruption, according to the firm.

The sectors with the most net buying were financials (+6.33%), communication services (+2.39%), and tech (+2.03%).

“The financial sector was the weakest performer in the S&P 500 last month, with brokerage and insurance stocks among the groups that experienced AI-related sales, at least temporarily,” Chris Larkin, managing director of trading and investing, said in a statement. “It also appears that clients are buying into the infiltration of some technology leaders who have suffered similar failures.”

Meanwhile, the sectors with the highest net selling are consumer staples (-8.01%), energy (-7.63%), and utilities (-3.96%)—”a possible case of selling to strength, because they are all among the strongest performers of the month,” he said.

deepened

“Cybersecurity Risk Reporting to the Board of Directors” is a white paper by ISACA, a global professional association focusing on IT governance, risk, security, auditing, and privacy. The paper covers key topics such as cyber risk as strategic risk, management programs, legal and regulatory concerns, the role of threat intelligence, and reporting and education for boards.

Heard

“Executives today face synthetic threats from two directions: their cloned likenesses to allow fraudulent transfers or inflict reputational damage, and AI-generated voices impersonating government officials, board members, and business associates used to manipulate them.”

—James Richardson, a senior managing director at global law firm Dentons, writes in a luck opinion piece titled, “Boards aren’t ready for the age of AI: What happens when your CEO gets deepfaked?”