The escalating sophistication of cyber threats, particularly those amplified by artificial intelligence, demands a fundamental re-evaluation of corporate compliance strategies, federal investigators declared at the 25th annual SCCE Compliance & Ethics Institute. A company that fails to adequately address cybersecurity risks, despite robust internal policies, is effectively undermining its own compliance efforts, a message driven home by speakers from the Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI). Compliance officers, often viewed as internal enforcers of rules, were challenged to adopt a more proactive, architectural role in building resilient organizations that can navigate the complex landscape of digital ethics and legal adherence.
Josh Goldfoot, Deputy Assistant Attorney General in the DOJ’s Criminal Division, articulated a vision of compliance professionals as "advisers and architects," tasked with constructing systems that ensure legal adherence, ethical conduct, and proactive problem-solving. He emphasized that cybersecurity must become a central tenet of this architectural responsibility. "If your organization is bad at cybersecurity, then ultimately, is it really complying with any of the policies you sought to enforce?" Goldfoot posed to compliance leaders gathered in Orlando, Florida, this week. This question resonates with growing urgency as the digital frontier becomes increasingly perilous.
The landscape of cybercrime is rapidly evolving, with fraudsters leveraging advanced AI-powered tools to enhance their reach and refine their attack methodologies. This trend is starkly illustrated by the FBI’s Internet Crime Complaint Center (IC3) data. In 2025, IC3 recorded over one million complaints for the first time in its history, a significant increase from approximately 860,000 the previous year. The financial toll of these crimes was equally staggering, with reported losses nearing $21 billion. This surge underscores a critical paradigm shift: rudimentary antivirus software is no longer sufficient for even organizations that may not perceive themselves as prime targets. As Goldfoot pointed out, "If you have money, and you’re connected to the internet, you are of interest to sophisticated hacking groups."
AI: Erasing Traditional Warning Signs and Elevating Threats
The accelerating pace of cybercrime is inextricably linked to the proliferation of artificial intelligence, according to Jason Cromartie, Special Agent in Charge of the FBI’s Cincinnati Field Office. Cromartie, who opened the general session on Monday, highlighted that phishing, a perennial favorite among attackers for gaining network access, has become significantly more insidious due to generative AI. These tools enable threat actors to craft messages that are far more sophisticated and less prone to detection than in previous years. The tell-tale signs of poor grammar and spelling, once reliable indicators of fraudulent communications, are rapidly disappearing, replaced by polished and persuasive language.
"These tools reduce the traditional warning signs and allow attackers to exploit trust at a whole new level," Cromartie stated, emphasizing the erosion of a fundamental defense mechanism. The threat extends beyond textual communication. Deepfake technology is becoming increasingly realistic, and voice-cloning capabilities are on the rise. Cromartie recounted an FBI investigation involving a Fortune 500 company that suffered a $1 million loss after an employee acted on a cloned voicemail, purportedly from the CFO, who was at the time overseeing a significant merger. Such sophisticated impersonations can bypass human scrutiny, creating a false sense of legitimacy.
Looking ahead, Cromartie identified "agentic AI" as the next frontier in cyber threats. These AI agents possess the capability to autonomously search for information, identify targets, generate convincing personas, and continuously attempt exploitation. This level of automation makes attacks significantly harder to detect and disrupt, posing a formidable challenge for both cybersecurity professionals and compliance teams. "We’re all trying to play catch-up to the rapid advances in the technology," Cromartie admitted.
Supporting this observation, IBM’s 2025 annual report on the cost of data breaches indicated that approximately one in six data breaches involved attackers utilizing AI. The most common AI-driven attack vectors identified were AI-generated phishing campaigns and deepfake impersonation attacks, underscoring the dual threat of deception and manipulation.
The Evolving Role of Compliance in a Digital Age
While AI may be amplifying the problem, it is not the root cause of cybersecurity vulnerabilities. The persistent human element remains a significant factor. For years, organizations have attempted to mitigate this by investing in training programs, including annual cybersecurity modules and simulated phishing exercises. Despite these efforts, business email compromise (BEC) remains the second-costliest category of cybercrime, accounting for over $3 billion in losses according to the FBI’s 2025 report. IBM’s findings further corroborate the prevalence of phishing, identifying it as the most common attack vector, responsible for 16% of all data breaches.
"Humans do not always make the best decisions," Cromartie observed, noting that threat actors frequently exploit this vulnerability. The impact of a single lapse in judgment can be catastrophic: "One person, one click can cause a lot of damage." This reality transforms cybercrime into a core ethics and compliance issue. Goldfoot urged compliance professionals to consider, "How are the interests that you work for, the values and ethics that you want your organizations to uphold, how is that affected by the new cybercrime threat?"
He illustrated this point by asking compliance leaders to consider the extensive measures organizations implement to protect sensitive data, such as patient information. The value of these safeguards diminishes significantly if an attacker can simply abscond with the data. This leads to a more profound question regarding the scope and influence of compliance departments: What level of oversight and authority should compliance have over cybersecurity practices? Furthermore, if an organization fails to accurately assess cyber threats, is this a deficiency that compliance can and should address?
Cromartie suggested that compliance leaders are uniquely positioned to tackle these challenges. "You have the responsibility to understand almost every aspect of the business operations that you’re with," he stated. "You have to see the big picture, you have to see what’s around the corner as well as over the horizon."
This forward-looking perspective must extend to the adoption of AI technologies. Cromartie strongly advised organizations implementing AI to establish robust governance frameworks with cross-functional ownership. This includes meticulously mapping who utilizes the technology, what data it accesses, rigorously measuring for security flaws and inherent biases, and deploying stringent guardrails, such as regular human audits. He also recommended a collaborative approach, bringing together a diverse group of stakeholders, including the Chief Information Officer (CIO), Chief Security Officer (CSO), legal counsel, and subject-matter experts.
The Imperative of Reporting: Why Law Enforcement Engagement is Crucial
Despite the escalating threat landscape, a significant number of victims remain hesitant to engage with law enforcement. Goldfoot recounted the FBI’s successful infiltration of the Hive ransomware group a few years prior. During this operation, investigators were able to identify companies under attack. While the FBI proactively warned targets and even provided decryption keys in some instances, they observed that only approximately 20% of victims had independently contacted law enforcement.
This pattern is mirrored in IBM’s findings, which revealed a decline in the percentage of ransomware attack victims who contacted relevant authorities, falling from 52% in 2024 to 40% in 2025. The reluctance to report is often driven by concerns about embarrassment and reputational damage. Many organizations opt to pay ransom demands in the hope of containing the crisis, but this is frequently a short-sighted strategy. A 2025 CrowdStrike survey revealed that a striking 83% of organizations that paid a ransom demand were subsequently attacked again, and 93% experienced data exfiltration regardless of payment.
The consensus from both Cromartie and Goldfoot is unequivocal: "Don’t pay." Goldfoot articulated this by stating, "Blackmail does not end until the victim of the blackmail decides that it ends." Cromartie concurred, emphasizing that even after a second payment, "there is nothing that prevents them from having that data they’ve taken, selling it." Furthermore, Goldfoot pointed out that some ransomware groups operate under U.S. sanctions, introducing a significant legal risk for any organization making payments to them.
Conversely, coming forward to law enforcement is presented not as an admission of failure, but as an act of victimhood. Goldfoot reassured attendees that law enforcement agencies treat reporting entities as crime victims, not as subjects of scrutiny. "You don’t go to a crime victim and start lecturing the crime victim about all the things they could have done to prevent being a crime victim."
The investigative process is designed to be collaborative and protective of the victim’s interests. Law enforcement agencies work through a company’s chosen forensics firm and receive only the information the company agrees to share. Court filings that identify victims are anonymized, and sensitive information is maintained within the criminal investigative file. "We’re not regulators," Goldfoot stressed, encouraging companies to cultivate relationships with law enforcement before an attack occurs, including through programs like the FBI’s InfraGard initiative.
Goldfoot concluded with a vital reminder: law enforcement cannot single-handedly combat the growing tide of cybercrime. Effective policing, he explained, is contingent upon community support. In the digital realm, this translates to protecting every individual with a computer. "We’ve struck fear in the hearts of some ransomware actors," he stated, expressing a desire to amplify that impact. The call to action for compliance leaders is clear: cybersecurity is no longer solely an IT concern; it is a fundamental component of ethical governance and organizational integrity, requiring proactive integration and strategic collaboration.
