Preparedness means knowing where the organization is exposed and making deliberate choices about what deserves greater protection.
Preventive work has an image problem. It asks for attention while operations are running, clients are being served, and nothing appears to be wrong. The expense is immediate; the benefit is largely the absence of a costly event.
Cybersecurity faces this problem more acutely than most business priorities. An organization may go years without a serious incident and begin to feel that its existing approach must be sufficient. It may be. It may also be fortunate.
In 2026, the ways organizations work have changed quickly, broadening access to sensitive information and creating exposures that may not be evident from an annual policy review. Artificial intelligence is part of that development, both as a useful business tool and as a means of making deception more credible. The issue every organization faces today is whether cybersecurity practices have kept pace.
Cybersecurity Awareness Month offers a useful reminder to pause and take a closer look. For leadership, that means understanding which risks could seriously disrupt operations and whether the organization has made a considered investment in reducing them.
A year ago, many organizations were still deciding whether and where to use artificial intelligence. In 2026, the more useful question is where it is already being used. Approved platforms may be easy to identify, but AI capabilities embedded in existing software or adopted informally by employees can be difficult to oversee. Leadership should have a clear understanding about which tools are touching sensitive information, what those providers do with the data, and who decides whether a use is appropriate. AAFCPAs advises that clients maintain an inventory of AI tools and define which employees could use them and how. We also recommend that organizations conduct a review of vendor data-retention and model-training practices based on the sensitivity of the information involved.
This broader use of AI illustrates a larger cybersecurity challenge: organizations cannot manage risks they cannot see. As leaders reassess their cybersecurity practices, three questions deserve particular attention:
Sensitive information now moves through more applications, vendors, and AI-enabled tools than many organizations realize. Leadership should understand which tools interact with sensitive information, how providers retain or use that data, and who determines whether a particular use is appropriate.
Organizations should maintain an inventory of approved AI tools, define who may use them and for what purposes, and review vendor data-retention and model-training practices based on the sensitivity of the information involved. Understanding where information resides and how it is used remains a foundational element to managing cybersecurity risk.
Polished writing, familiar branding, and even a recognizable voice are no longer reliable indicators of legitimacy. Requests involving payments, access credentials, sensitive information, or changes to established instructions should be verified through a trusted channel, even when the request appears routine.
Organizations should establish clear verification procedures so employees know when and how to confirm a request independently. These procedures are most effective when they are defined before an urgent or convincing request is received.
Cybersecurity policies and controls often remain in place while technology and business practices around them continue to change. Assumptions about privileged access, remote work, vendor dependencies, recovery priorities, or the use of AI-enabled applications may no longer reflect how the organization actually operates.
Leaders should periodically test whether existing safeguards, responsibilities, and response plans remain appropriate. Assumptions that felt reasonable a year ago may warrant another look today.
The common thread is visibility. Organizations are better positioned to manage cybersecurity risks when leadership understands where sensitive information is moving, how consequential requests are verified, and which longstanding assumptions may no longer be valid. That visibility allows risks to be addressed before they disrupt operations.
Cybersecurity is ultimately an investment in the organization’s ability to continue operating. A serious incident can interrupt business, place confidential information beyond the organization’s control, and force consequential decisions under extraordinary pressure. Preparation gives leaders more options when those decisions matter most.
Leadership should know which business functions must be restored first and who has the authority to make time-sensitive decisions. Backups should be tested rather than presumed reliable, and incident-response plans should be rehearsed with the people expected to carry them out. A tabletop exercise can identify unclear responsibilities, missing information, and unrealistic assumptions while there is still time to address them.
This preparation also helps organizations make more deliberate cybersecurity investments. By understanding their most consequential exposures, leaders can direct resources toward protecting the systems, information, and operations that matter most rather than reacting to every emerging threat or product.
Cybersecurity Awareness Month is an opportune time to consider whether the organization’s preparation has kept pace with its changing operations and risks. The decisions leaders make now will influence the organization’s ability to respond, recover, and continue operating when its safeguards are tested.
AAFCPAs’ Cybersecurity Risk Management Advisors help organizations evaluate cyber risk through an independent lens. We combine experience in cybersecurity, enterprise risk management, internal controls, compliance, business continuity, and AI governance to help leadership identify blind spots, challenge assumptions, and focus on the risks that could meaningfully disrupt operations or impede strategic objectives.
Our services include cybersecurity assessments, penetration testing, vulnerability management, AI governance, vCISO services, incident response planning, business continuity and disaster recovery, regulatory readiness, and third-party risk assessments. By connecting technical risk with governance and business operations, we help leaders make informed decisions and invest confidently in resilience.
These insights were contributed by Vassilis Kontoglis, Partner, AI Digital Transformation & Security and Michael Anderson, CISSP, CEH, CCNP, Consulting CISO & Certified Ethical Hacker.
Questions? Reach out to our authors directly or your AAFCPAs partner.
AAFCPAs offers a wealth of resources on cybersecurity and IT risk. Subscribe to get alerts and insights in your inbox.
Author Bio
More Articles
New 1099 reporting thresholds are in effect for 2026. Businesses should understand what has changed and review vendor records, W-9 information, and payment activity before...
In her latest column in The Bay, Carmen Grinkis, PhD, CLTC, CLU®, CFP®, Co-Managing Partner & Wealth Advisor at AAF Wealth Management, explores the surprising...
What we choose to keep, change, or leave behind can reveal a great deal about our priorities. Carmen Grinkis considers how the clarity that follows...
