Compliance leaders are no longer just internal auditors or ethics enforcers; they are now pivotal architects of organizational resilience in an increasingly perilous digital world. This paradigm shift was a central theme at the 25th annual SCCE Compliance & Ethics Institute, where federal investigators underscored a stark reality: a company with inadequate cybersecurity practices cannot truly claim to be compliant with its own policies, let alone legal and ethical obligations. Jennifer L. Gaskin of Corporate Compliance Insights reported on the critical discussions that positioned cybersecurity as an indispensable component of modern compliance strategies.
Josh Goldfoot, Deputy Assistant Attorney General in the U.S. Department of Justice’s Criminal Division, challenged the conventional view of compliance officers as mere internal police. Instead, he advocated for a more proactive role, envisioning them as "advisers and architects that are creating systems that help your organizations follow the law, behave ethically and head off problems." This reframing, Goldfoot argued, necessitates the immediate integration of cybersecurity into the core responsibilities of compliance departments. His pointed question to attendees at the Orlando-based institute resonated deeply: "If your organization is bad at cybersecurity, then ultimately, is it really complying with any of the policies you sought to enforce?"
The urgency of this message is amplified by the escalating sophistication of cyber threats, particularly those leveraging advancements in artificial intelligence (AI). Fraudsters are increasingly employing AI-enabled tools to broaden their reach and refine their attack methodologies. The FBI’s Internet Crime Complaint Center (IC3) reported a significant surge in reported incidents, logging over one million complaints for the first time in 2025, a notable increase from approximately 860,000 the previous year. The financial toll of these crimes is equally staggering, with reported losses nearing $21 billion in 2025. This trend signals a fundamental departure from an era where basic antivirus software was considered sufficient protection, even for organizations that did not perceive themselves as high-value targets. As Goldfoot emphasized, "If you have money, and you’re connected to the internet, you are of interest to sophisticated hacking groups."
AI’s Disruptive Influence on Cybercrime
The exponential growth in cybercrime statistics, as highlighted by the FBI, is significantly propelled by artificial intelligence. Jason Cromartie, Special Agent in Charge of the FBI’s Cincinnati Field Office, opened the institute’s general session by detailing how AI is revolutionizing threat actor capabilities. Phishing, long a primary vector for network infiltration, has become more potent. Generative AI tools enable attackers to craft highly convincing phishing messages that circumvent traditional detection methods. The tell-tale signs of poor grammar and spelling are rapidly disappearing, replaced by sophisticated, contextually relevant communications.
"These tools reduce the traditional warning signs and allow attackers to exploit trust at a whole new level," Cromartie stated. The realism of deepfakes is also increasing, with voice cloning emerging as a particularly insidious threat. Cromartie recounted an FBI investigation involving a Fortune 500 company that suffered a $1 million loss when an employee acted upon a cloned voicemail from the CFO, who was reportedly overseeing a crucial merger at the time. This incident underscores the erosion of trust in seemingly authentic communications.
Looking ahead, Cromartie identified "agentic AI" as the next frontier. These AI agents are capable of independently researching targets, crafting exploitation strategies, and developing convincing personas, allowing for continuous and automated attacks that are exceptionally difficult to detect and disrupt. "We’re all trying to play catch-up to the rapid advances in the technology," Cromartie admitted, reflecting the challenging arms race between defenders and attackers.
IBM’s 2025 annual report on the cost of data breaches corroborates this trend, indicating that approximately one in six data breaches involved attackers utilizing AI. The most common applications of AI in these attacks were AI-generated phishing campaigns and deepfake impersonation schemes. This confluence of AI capabilities and established attack vectors creates a formidable challenge for organizations worldwide.
The Imperative for Compliance in Cybersecurity
While AI is undeniably accelerating the cyber threat landscape, it is not the root cause of the vulnerabilities. The persistent human element remains a critical factor, and organizations have historically relied on training to mitigate this risk. Regular cybersecurity modules and simulated phishing exercises have become standard practice across industries and company sizes.
Despite these efforts, Business Email Compromise (BEC) remains the second-costliest category of cybercrime, accounting for over $3 billion in losses, according to the FBI’s 2025 report. IBM’s findings further highlight the prevalence of phishing, identifying it as the most common attack vector, responsible for 16% of all data breaches documented in their report.
"Humans do not always make the best decisions," Cromartie observed. "Threat actors are often using that as a vector." The simplicity of the exploit—"One person, one click can cause a lot of damage"—underscores the persistent need for robust human-centric defenses and a comprehensive understanding of organizational vulnerabilities.
Goldfoot framed cybercrime as an intrinsic ethics and compliance issue. He urged compliance leaders to consider the direct impact of these threats on the values and ethics they strive to uphold within their organizations. "How are the interests that you work for, the values and ethics that you want your organizations to uphold, how is that affected by the new cybercrime threat?" he questioned.
He posited a scenario involving an organization’s meticulous efforts to protect patient information. If an attacker can simply extract that data, the value of those implemented checks and balances is severely diminished. This leads to a more profound question about the integration of compliance and cybersecurity: What level of influence and oversight should compliance departments wield over cybersecurity practices? Furthermore, if an organization fails to accurately assess its cyber threat landscape, is that a remediable gap that compliance can address?
Cromartie suggested that compliance leaders are uniquely positioned to tackle these challenges due to their broad understanding of business operations. "You have the responsibility to understand almost every aspect of the business operations that you’re with," he explained. "You have to see the big picture, you have to see what’s around the corner as well as over the horizon."
This holistic perspective must extend to the adoption of AI. Cromartie strongly recommended that organizations implementing AI tools establish comprehensive governance frameworks with cross-functional ownership. This includes mapping the usage of the technology, identifying the data it accesses, rigorously measuring for security flaws and inherent biases, and deploying stringent guardrails, such as regular human audits. He also emphasized the importance of engaging a broad spectrum of stakeholders, including the Chief Information Officer (CIO), Chief Security Officer (CSO), legal counsel, and relevant subject-matter experts, in the AI governance process.
The Critical Role of Law Enforcement Engagement
Despite the escalating threats and the clear imperative to report, a significant number of victims remain hesitant to contact law enforcement. Goldfoot recalled the FBI’s successful infiltration of the Hive ransomware group a few years prior. During this operation, investigators could identify targeted companies, provide warnings, and even offer decryption keys. However, they also observed that only about 20% of victims proactively reported the attacks to law enforcement.
This reluctance is echoed in IBM’s report, which noted a decline in organizations contacting relevant authorities following a ransomware attack. In 2024, 52% of victimized organizations reported to authorities, a figure that dropped to 40% in 2025.
Several factors contribute to this hesitancy, with embarrassment and reputational damage being primary concerns. Many organizations opt to pay ransom demands in the hope of quickly resolving the crisis. However, the aftermath often proves more complex. A 2025 CrowdStrike survey revealed that 83% of organizations that paid a ransom demand were subsequently attacked again, and 93% experienced data theft regardless of payment.
Both Cromartie and Goldfoot delivered a clear and consistent message: "Don’t pay." Goldfoot articulated the principle that "Blackmail does not end until the victim of the blackmail decides that it ends." Cromartie concurred, emphasizing that even after a second payment, "there is nothing that prevents them from having that data they’ve taken, selling it." Furthermore, Goldfoot highlighted that some ransomware groups operate under U.S. sanctions, introducing a legal risk for any organization making payments to them.
Conversely, coming forward to law enforcement is presented not as an admission of fault but as a crucial step in victim recovery. Goldfoot assured attendees that law enforcement agencies treat reporting entities as crime victims, not suspects. "You don’t go to a crime victim and start lecturing the crime victim about all the things they could have done to prevent being a crime victim," he stated.
Investigators work collaboratively with a company’s chosen forensics firm, receiving only the information the organization agrees to share. Court filings identify victims anonymously, and all shared information is kept within the criminal investigative file. "We’re not regulators," Goldfoot emphasized, underscoring the supportive rather than punitive role of law enforcement in these scenarios. He strongly advised companies to proactively build relationships with law enforcement agencies, such as through the FBI’s InfraGard program, before an attack occurs.
Goldfoot concluded with a vital reminder that law enforcement cannot effectively combat cybercrime in isolation. "Every type of policing," he asserted, "only works when we have the support of the community that we’re trying to protect. And in our case, that means protecting everyone with a computer." He expressed a desire to further instill fear in ransomware actors but acknowledged that this requires a concerted effort from all parties. The message from the SCCE Compliance & Ethics Institute was clear: cybersecurity is not merely an IT issue; it is a fundamental compliance imperative that demands the attention and expertise of every leader within an organization.
