Welcome, everyone, to this edition of Executive Edge: Cybersecurity Readiness in a High-Stakes Environment, where we bring timely insights and sharp executive perspectives to the biggest challenges and opportunities facing today’s business leaders.
For financial institutions and other high-stakes industries, cybersecurity readiness is essential—not just for risk mitigation, but to ensure operational continuity, protect brand trust, and enable long-term business growth.
So how are executive teams preparing?
What should CEOs and CFOs be asking and prioritizing to safeguard their organizations while still advancing strategic goals?
Joining us today are two executives from Hartman who bring deep perspective to these questions.
First, Shea is our Vice President of Relationship Development. Shea partners with leaders across financial services and other regulated industries to ensure their technology investments—including cybersecurity—are strategically aligned with broader business goals. His cross-sector experience gives him a unique lens on how organizations are navigating and evolving risk and rising stakeholder expectations.
We also have Chad with us today. Chad is the CISO here at Hartman, who has spent his career helping organizations in highly regulated industries design and execute cybersecurity strategies that are practical, risk-informed, and closely tied to business outcomes. He works directly with CISOs and executive teams to elevate cybersecurity from a technical function to an enterprise-wide priority.
We’re thrilled to have them both here to share their insights. So let’s dive in.
My first question, Chad, is going to go directly to you. You often say that cybersecurity isn’t just a technical issue—it’s actually a business risk. Can you unpack what that means in the context of financial institutions and how leadership should be thinking about it alongside other risks like credit and liquidity?
Chad Quarles (2:15):
Sure. Yeah. I think it’s common that financial institutions initially begin managing cybersecurity as a purely technical issue and have delegated that to their IT team to handle. But as financial institutions continue to mature their information security programs, they really need to start managing cybersecurity as a business risk, just like they would credit risk or liquidity risk. Because if we’re considering the business impact, they’re very similar.
A cybersecurity incident can result in regulatory penalties, reputational damage, loss of trust, and any number of financial losses.
Shea Gabrielleschi (2:56):
So what are some ways for executives to start? I talk to a lot of bank CEOs and COOs, and they’re in that spot you mentioned—managing it as a technical issue—and they become aware, “Okay, we need to make this strategic shift.” What do you recommend for getting started with that? What are some small steps in the right direction, Chad?
Chad Quarles (3:21):
Yeah, I think the first thing to do is establish an Information Security Steering Committee that’s comprised of leadership from across the organization and charge that group with governance and oversight of the security program.
The initial reaction might be to delegate risk tolerance and security program oversight solely to the Chief Information Security Officer and have them decide what level of risk is acceptable. But the best approach is to form that committee, document your cybersecurity risk tolerance or risk appetite, and make sure the CISO can articulate cybersecurity risk in business terms to that leadership group.
That way, the executive team is informed and can determine what level of risk they’re willing to accept.
Lauren Langer (4:25):
Interesting.
Chad Quarles (4:26):
The CISO certainly will make recommendations on appropriate risk responses—whether something needs further mitigation or has been sufficiently addressed—and they’ll recommend how to do it. But it’s important that business leadership makes the final determination on what is acceptable.
Every financial institution accepts some level of risk to do business. We just want to ensure they understand the risks they’re accepting.
Shea Gabrielleschi (5:11):
Yeah, that sounds like a big change, but from my perspective, it doesn’t seem overly complicated. When you talk to a bank executive, one of the first things they say keeps them up at night is this issue. It’s not one that’s neglected—it’s top of mind, and they’re intimately aware of it. So putting the onus on them to own that and stay in close communication with the cyber team makes sense.
Lauren Langer (5:54):
My next question is for both of you. Shea, as you’re attending conferences and talking with bank executives, and Chad, from what you’re seeing in the market—what are the emerging threats in the current landscape, and how are they impacting business operations?
Shea Gabrielleschi (6:25):
Yeah, I’ll just say quickly, and then I’ll let Chad dive into more detail. I just got back from a state banking association conference. There were many breakout sessions, but one keynote speaker had a two-hour session with the whole audience—mostly bank executives—and he spoke on how AI is influencing cyber threats.
He walked through elaborate schemes, like mimicking the identity of a bank CEO using AI-generated deepfakes that are significantly more accurate than they were just months ago. That really unsettled a lot of people in the room.
Afterward, many bank leaders shared that they’re not just worried about where AI is today—but even more so about where it’ll be in six months or a year. The threats are becoming so sophisticated that smaller, community banks especially—without unlimited resources—are left wondering how they can defend themselves.
Chad Quarles (8:33):
Yeah, I agree. These threat actors are opportunistic. They don’t discriminate based on institution size. I’m seeing organizations both large and small targeted.
For example, we’ve seen attackers use fake CAPTCHA windows to trick employees into entering malicious code. It’s a new vector—CAPTCHAs are typically a trusted security feature, so people aren’t trained to treat them as suspicious.
We’re also seeing elaborate tech support scams. Attackers bombard victims with spam emails, then follow up by impersonating the IT department, claiming they need to remote in to resolve the issue. These social engineering attacks are getting far more convincing—likely aided by AI.
Another recent development is the use of third-party AI tools to record and transcribe sensitive meetings. We’ve seen scenarios where these recordings are stored insecurely, and even publicly accessible via shared links. That’s showing up on clients’ risk registers, and we’re actively advising how to address it.
Lauren Langer (12:00):
That’s a great point, Chad. Third-party tools are deeply ingrained in how people expect to work today. So what’s the real risk, and how can leaders manage it without slowing down innovation or growth?
Chad Quarles (12:36):
It’s a balancing act. SaaS and third-party tools enable agility and scale. In many cases, they can be secure—because the vendor carries some of the overhead. But you must do due diligence. The vendor’s security posture directly impacts your data security and reputation.
Shadow IT is a huge challenge. The days of requesting software through centralized IT are gone. Now users can spin up tools on their own. So having clear acceptable use policies and technical controls is critical to prevent unapproved apps from entering secure environments.
Lauren Langer (14:09):
Absolutely. For my last question—how are executive teams aligning cybersecurity strategies with business growth, including M&A activity and digital transformation? Institutions are trying to grow, regardless of the economy.
Shea Gabrielleschi (14:42):
At Hartman, our main thesis is that IT and cybersecurity strategies must be aligned with business strategy. That’s where it all starts. Executives should be asking: How is our steering committee structured? How often do they meet? Who sees the findings? Where’s the feedback loop? These are fundamental alignment questions.
Chad Quarles (15:41):
Yes, and when your security program is aligned with the strategic plan, it becomes an enabler—not an obstacle. It shouldn’t be seen as the “department of no.” We want to help the business do what it needs to do—securely.
The key is integrating security teams early—before a project launches. That way, security is built in from the start, not bolted on afterward. Post-incident urgency is common, but ideally, we’re proactive.
Connecting the dots between security initiatives and business goals helps everyone see the value of the program. That’s not always obvious at first, but it’s essential.
Lauren Langer (17:08):
If a CEO feels like their cyber team is just going to say “no” to everything, is that a red flag?
Chad Quarles (17:34):
Yes, it’s a sign there are underlying issues. If people are working around the cybersecurity team, you’re in a much riskier situation than if they’re working with it. That’s a leadership problem.
Shea Gabrielleschi (18:03):
We’re in a very different time. Some bank leaders still operate with a 2019 mindset—but the landscape has changed. Aligning your cybersecurity strategy with your business strategy is no longer a luxury—it’s a necessity.
Chad Quarles (18:36):
Agreed. If your cybersecurity program is working well, it’s a business differentiator. Secure product delivery builds customer trust. A cyber incident is a terrible user experience. Security done right can set your business apart.
Lauren Langer (19:17):
Thank you, Chad and Shea, for your time today. And to our listeners—if you enjoyed today’s conversation, be sure to subscribe and join us next time for Executive Edge.
