A company that demonstrates weakness in cybersecurity is fundamentally failing to uphold the very policies it endeavors to enforce. This stark reality was the central message delivered by federal investigators to compliance leaders at this year’s SCCE Compliance & Ethics Institute. Jennifer L. Gaskin of CCI reports on the critical call to action for compliance professionals to integrate robust cybersecurity strategies into their core functions.
Compliance officers are often perceived as the internal enforcers within their organizations, tasked with navigating complex regulatory landscapes and ethical minefields. However, Josh Goldfoot, a deputy assistant attorney general in the U.S. Department of Justice’s Criminal Division, presented a more forward-thinking perspective. He characterized compliance officers not merely as internal auditors, but as "advisers and architects that are creating systems that help your organizations follow the law, behave ethically and head off problems." It is within this expanded role that Goldfoot emphatically urged these leaders to prioritize cybersecurity on their agendas.
"If your organization is bad at cybersecurity, then ultimately, is it really complying with any of the policies you sought to enforce?" Goldfoot challenged attendees at the SCCE’s 25th annual Compliance & Ethics Institute, held in Orlando. This question, posed in the face of escalating cyber threats, underscores a paradigm shift: cybersecurity is no longer solely the domain of IT departments, but a fundamental ethical and compliance concern.
The urgency of this message is amplified by the increasing sophistication of cybercriminals, who are leveraging artificial intelligence (AI) to broaden their reach and refine their attack methodologies. The FBI’s Internet Crime Complaint Center (IC3) reported a significant surge in reported incidents, logging over one million complaints for the first time in 2025. This represents a substantial increase from approximately 860,000 complaints in the preceding year, with financial losses mounting to nearly $21 billion. This trend highlights a critical juncture where traditional security measures are becoming increasingly insufficient.
Goldfoot stressed that the era of relying solely on basic antivirus software has long passed, even for organizations that may not perceive themselves as high-value targets. "If you have money, and you’re connected to the internet, you are of interest to sophisticated hacking groups," he stated, directly addressing the assembled compliance executives. This assertion emphasizes that any entity with financial resources and an online presence is a potential victim, necessitating a proactive and comprehensive defense strategy.
AI: The Silent Accelerator of Cyber Threats
The dramatic increase in cybercrime statistics, as highlighted by the FBI’s IC3 data, is significantly driven by advancements in AI. Jason Cromartie, special agent in charge of the FBI’s Cincinnati field office, who opened the general session, elaborated on this critical development. Phishing attacks, a persistent gateway for cybercriminals, have become far more insidious. Generative AI tools are now capable of crafting phishing messages that are virtually indistinguishable from legitimate communications, effectively eliminating the tell-tale grammatical errors and spelling mistakes that once served as an early warning sign.
"These tools reduce the traditional warning signs and allow attackers to exploit trust at a whole new level," Cromartie explained. This capability represents a fundamental challenge to human vigilance, as AI-generated content can bypass cognitive defenses that were once effective.
The proliferation of highly realistic deepfakes and the increasing prevalence of voice cloning technology further exacerbate this threat landscape. Cromartie recounted an FBI investigation involving a Fortune 500 company that suffered a $1 million loss due to an employee falling victim to a voice-cloned voicemail. The fraudulent message, impersonating the CFO, was used to authorize a transaction during a critical merger negotiation. Such sophisticated impersonation tactics erode the trust that is essential for business operations and employee collaboration.
Looking ahead, Cromartie identified "agentic AI" as the next frontier in cyber threats. AI agents possess the capability to autonomously search for information, identify targets, construct convincing personas, and continuously attempt exploitation. This autonomous and adaptive nature makes these attacks exceptionally difficult to detect and disrupt, presenting a formidable challenge for existing security frameworks. "We’re all trying to play catch-up to the rapid advances in the technology," Cromartie admitted, underscoring the dynamic nature of the cyber threat landscape.
IBM’s 2025 annual report on the cost of data breaches corroborates these concerns. The report indicated that approximately one in six data breaches involved attackers utilizing AI, primarily through AI-generated phishing campaigns and deepfake impersonation attacks. This data point highlights a clear correlation between AI adoption by malicious actors and the success rate of cyberattacks.
The Evolving Role of Compliance in Cybersecurity
While AI is undeniably amplifying the problem, the root cause of many cybersecurity vulnerabilities often lies in the human element. For years, organizations have attempted to mitigate these risks through extensive employee training, including annual cybersecurity modules and simulated phishing exercises. Despite these efforts, Business Email Compromise (BEC) remains a significant financial drain. The FBI’s 2025 report identified BEC as the second-costliest category of cybercrime, responsible for over $3 billion in losses. Furthermore, IBM’s findings indicated that phishing was the most common attack vector, accounting for 16% of all data breaches documented in their report.
"Humans do not always make the best decisions," Cromartie stated candidly. "Threat actors are often using that as a vector." The impact of a single lapse in judgment can be catastrophic: "One person, one click can cause a lot of damage." This underscores the persistent challenge of human fallibility in the face of sophisticated social engineering tactics.
For Goldfoot, this human vulnerability transforms cybercrime into an intrinsic ethics and compliance issue. He posed a critical question to the audience: "How are the interests that you work for, the values and ethics that you want your organizations to uphold, how is that affected by the new cybercrime threat?" This framing compels compliance professionals to consider the direct impact of cyber incidents on an organization’s core principles and commitments.
He further elaborated by using the example of patient data protection. An organization might invest heavily in implementing robust checks and balances to safeguard sensitive patient information. However, if an attacker can simply "walk off with the data," the efficacy of those internal controls is rendered moot. This leads to a more profound question regarding the authority and scope of compliance functions: "How much influence, and how much oversight, should compliance have over cybersecurity practices?" Furthermore, Goldfoot questioned whether compliance can effectively intervene if an organization is failing to accurately assess its cyber threat landscape.
Cromartie suggested that compliance leaders are uniquely positioned to address these challenges. "You have the responsibility to understand almost every aspect of the business operations that you’re with," he noted. "You have to see the big picture, you have to see what’s around the corner as well as over the horizon." This holistic understanding of the business, coupled with foresight into emerging threats, makes compliance professionals invaluable in bridging the gap between business objectives and cybersecurity imperatives.
This proactive approach must extend to the adoption of AI. Cromartie strongly recommended that organizations implementing AI technologies establish comprehensive governance frameworks with cross-functional ownership. This includes mapping the usage of AI technologies, understanding the data they access, rigorously measuring for security flaws and inherent biases, and deploying stringent guardrails, supported by regular human audits. He also emphasized the importance of broad stakeholder engagement, advocating for the inclusion of the Chief Information Officer (CIO), Chief Security Officer (CSO), legal counsel, and relevant subject-matter experts in these discussions.
The Strategic Imperative of Reporting Cyber Incidents to Law Enforcement
Despite the escalating threat landscape, a significant number of victimized organizations remain hesitant to engage with law enforcement. Goldfoot cited a striking example from a few years prior when the FBI successfully infiltrated the Hive ransomware group. During the operation, investigators gained visibility into the group’s targets. While the FBI proactively warned potential victims and even provided decryption keys in some instances, they observed that only approximately 20% of the identified targets had independently contacted law enforcement.
This reluctance is mirrored in IBM’s findings, which revealed a decline in reporting to relevant authorities among organizations experiencing ransomware attacks. The share of victims reporting such incidents fell from 52% in 2024 to 40% in 2025. This trend suggests a growing inclination among companies to attempt to resolve cyber incidents internally, potentially to avoid public scrutiny or reputational damage.
The reasons for this hesitation are understandable. Embarrassment, fear of reputational damage, and the hope of a swift resolution often lead organizations to pay ransom demands. However, this approach rarely provides a permanent solution. A 2025 CrowdStrike survey revealed that a staggering 83% of organizations that paid a ransom demand were subsequently attacked again, and 93% reported that their data had been stolen regardless. This data strongly suggests that paying ransoms is not only ineffective in preventing future attacks but also fails to secure data already compromised.
Both Cromartie and Goldfoot delivered a clear and unequivocal message to organizations facing cyber extortion: "Don’t pay." Goldfoot articulated the principle behind this advice: "Blackmail does not end until the victim of the blackmail decides that it ends." Cromartie concurred, emphasizing that even after a second payment, there is no guarantee that attackers will not sell the stolen data. Furthermore, Goldfoot highlighted an often-overlooked legal risk: some ransomware groups are subject to U.S. sanctions, meaning that making a payment could constitute a violation of federal law.
In stark contrast to the risks associated with paying ransoms, coming forward to law enforcement is presented as a pathway to support and remediation. Goldfoot assured attendees that law enforcement agencies treat reporting entities as crime victims, not as suspects. "You don’t go to a crime victim and start lecturing the crime victim about all the things they could have done to prevent being a crime victim," he stated, emphasizing a supportive and collaborative approach.
Federal investigators work in conjunction with a company’s chosen forensics firm, receiving only the information that the victim organization agrees to share. Court filings that identify victims are anonymized, and sensitive information is kept strictly within the criminal investigative file. "We’re not regulators," Goldfoot clarified, underscoring that their role is not to impose penalties but to assist in recovery and prosecution. He strongly encouraged companies to establish proactive relationships with law enforcement before an incident occurs, recommending programs like the FBI’s InfraGard initiative, which facilitates public-private partnerships for critical infrastructure protection.
Goldfoot concluded his remarks with a crucial reminder: law enforcement cannot solve the cybersecurity crisis in isolation. "Every type of policing," he asserted, "only works when we have the support of the community that we’re trying to protect. And in our case, that means protecting everyone with a computer." He expressed optimism, noting that law enforcement has successfully "struck fear in the hearts of some ransomware actors," but stressed the need to amplify these efforts. The message is clear: a united front, combining robust corporate cybersecurity practices with proactive engagement with law enforcement, is essential to combatting the ever-evolving landscape of cyber threats.
