Businesses are rushing to go digital. Is security keeping pace?

The person who put this together isn’t asking the employee to trust a stranger. They’re trying to convince them that the person writing is someone they already trust.

This is where cybersecurity intersects with one of the most sensitive issues in a business’s life: trust.

We are used to thinking that a cyber threat must have some recognisable feature: an unusual message, a suspicious request, an obvious error. But the most effective scams are often those that manage to blend in with the ordinary. They exploit actions we carry out every day.

Today, with tools capable of reproducing language, images and even voices with ever-increasing accuracy, it is becoming even more difficult to distinguish what is genuine.

Over the years, we have invested in digitalisation to make businesses faster, more efficient and better connected. We have streamlined procedures and automated tasks. These are extraordinary opportunities, but they have also increased exposure to risks. The compromise of a single point of access can put confidential data at risk, bring a process to a standstill and have consequences for customers, suppliers and business continuity.

The question is whether our awareness has kept pace with technological progress. All too often, cybersecurity remains a matter left solely to specialists. Their expertise is essential, but it is not enough.

Every day, people exchange documents, authorise transactions and handle information. We cannot expect them to become IT experts or to spot every instance of fraud: deception techniques evolve far too quickly. We can, however, invest in practical, ongoing training that teaches people to spot unusual signs and know how to respond, without fuelling fear or mistrust.

At the same time, we need effective and up-to-date protection systems: filters to block fraudulent messages, access controls, monitoring and procedures for responding to incidents. Training and technology are not alternatives: each must support the other.

When something goes wrong, simply identifying who clicked means only scratching the surface. The responsibility of a business leader also lies in asking why that mistake might have had consequences and what measures could have been taken to mitigate them.

So let’s go back to that simple email with my name in it.

The point is not merely to recognise it as a hoax, but to understand what would happen if someone were actually to click on the link. A knowledgeable person might spot the anomaly; appropriate safeguards might prevent unauthorised access; and a prompt response might limit the damage.

No safeguard can eliminate all risk. But we can build organisations where safety does not depend on the hope that nobody will make a mistake, but rather on the ability to prevent a mistake from jeopardising everyone’s work.

(*) Chief Executive of the Piramis Group