Online Visibility Puts Executives At Risk, Expert Says

The leaders of the world’s top organizations most likely have a horror story or two about their safety being compromised. Sam Altman, CEO of OpenAI, for example, recently had a Molotov cocktail thrown at his house.

Social media has made executives more visible online, as has the changing nature of leadership. Similarly, AI makes gathering personal information easier, and impersonation and voice scams have become more sophisticated through AI use.

I spoke to Olga Polishchuk, vice president of investigations at ZeroFox, who deals directly with digital exposure and how it can compromise organizational and personal safety. The point isn’t to be invisible, she says. Instead, what’s most important is removing and monitoring what’s available online.

Digital Environments Can Advance Executive Attacks

The issue of executive attacks is nothing new, Polishchuk tells me. “What’s different is how much we can learn about somebody without getting physically close to them,” she says.

Across social media platforms like Instagram or LinkedIn, individuals are encouraged to share their lives online. What started as a point of connection, however, has evolved to become a larger ground on which to stage an attack.

Everything from corporate appearances to family social outings can be used to establish a pattern of predictability. Whatever criminals are missing, it’s likely they can get from data brokers, who provide information like residential history and personal information like date of birth, at a very low cost.

Polishchuk says when you look at the information out there on an independent level, it’s not so concerning. But, when it’s used to together, to build what she calls “a pattern of life,” then it becomes a problem.

AI Is Accelerating Threats, Human Instincts are Dwindling

The tools attackers are working with have also improved. AI is frequently employed in impersonation attacks, through the creation of deepfakes and for voice phishing scams. Similarly, Polishchuk points out how consumer AI tools can also be used to crawl the internet for information on executives.

“It’s so easy to bypass ChatGPT or Claude’s more ethical barriers and guidelines,” she says. By choosing the right prompt, for example, you can get AI to generate what would be a very convincing spam email.

Polishchuk works with executives to help them deal with these new threats. She tells me a lot of them are clicking on these emails, convinced by what they’re telling them. “Human instincts no longer work at this point,” she says.

We’re no longer in a world where it was easy to discern what is AI, and what isn’t. The models have developed, and they’ve done it fast.

Our old methods of discerning what is trustworthy through human instinct may be increasingly void. Polishchuk points out that a lot of things we used to use to determine trust, like someone’s face on a call, or their voice, can be easily fabricated using AI.

However, Polishchuk does believe human instinct will still play a role in safety. “I don’t think human judgement is obsolete, but I think that familiarity as a form of authentication might be becoming that.” What we’ll have to do, she explains, is change the way we’re identifying threats.

Navigating Modern Leadership with Increased Online Visibility

Despite these threats, it’s unrealistic to tell modern day leaders to be invisible online. The demands of the role have changed; consumers like brands and leaders they can relate to, and a lot of this comes with having a unique voice. Similarly, executives still need to make public appearances, and even write the occasional press release or take an interview.

I asked Polishchuk how executives can manage their visibility. “I would tell them to be intentional about what is visible,” she says.

“There’s a big difference between professional visibility and personal predictability. If people know you’re speaking at a conference, they don’t need to know what hotel you’re staying at, or if you ran a marathon.” – Olga Polishchuk, VP of investigations at ZeroFox

On the topic of marathons, she explains instances where executives have been targeted on their local running route, after they had posted it to online fitness apps. This is the kind of visibility you might not think of as a threat initially.

Polishchuk isn’t telling executives not to live their lives. It’s important, for both personal and professional wellbeing, to be visible. Instead, executives shouldn’t let it get to a point where their personal movements and routines can be mapped out. Like through their morning run, for example.

“What we’re trying to help them understand is which information creates exposure risk and which serves a legitimate purpose. Visibility isn’t always a problem. It’s the predictability that is,” she says.

How to Protect Your Leaders and Organization

Preparation is key. Polishchuk recommends that businesses should “start thinking like an adversary” before any threats reveal themselves. “Pick your top five executives and look at their online ecosystem: what surrounds them, what kind of information is publicly available,” she says.

From the information you find, determine if it can be used to establish a person’s routine. “It’s really more about eliminating unnecessary exposure,” she adds. Once you’ve reduced what’s not needed, continue to monitor the situation.

“Digital exposure is not a one-time thing. It’s a condition that you have to manage.” – Olga Polishchuk, VP of investigations at ZeroFox

Similarly, when I asked Polishchuk what’s most important for businesses today, education was her top choice. Understanding what’s out there, and what kind of information threat actors are going to go after.

This extends beyond the organization and the leader as well. “We meet with children, we meet with spouses, and we just use examples of their exposure to provide different scenarios.”

All of this will ensure everyone involved understands the risks and will help protect your leaders and your business, in the long run.