Audit committees and cyber security: New threats, new tools and the fundamentals

Each year organizations become more digitally interconnected and each year, cyber risk evolves. Increasingly, audit committees are being tasked with oversight of cyber risk management and, as a result, they need to keep abreast of new developments. Among these are the increased risk from supply chains, the burgeoning use of AI to both perpetrate and combat attacks and the growing realization that cyber resilience must be more rigorously evaluated and managed.

Nation states and organized crime remain the primary threat actors. In the past year, heightened global geopolitical disruption drove an increase in state-sponsored cyber threats. At the same time, organized criminal activity, which had seen a brief lull, returned as strong as ever with a focus on recruiting corporate insiders in addition to traditional activities like ransomware attacks. Threat actors are also exploiting vulnerabilities in widely used digital products, allowing them to breach multiple organizations at once without a specific target.

Audit committees are putting supply chain security higher on the agenda in the wake of several high-profile third-party compromises—where an organization’s environment is breached through a vendor or supplier’s IT systems. As the threat from these attacks intensifies, management can no longer treat them as just one of many points of failure. Instead, they must dig deeper, think creatively to anticipate these breaches and audit committees should evaluate whether the organization is taking sufficient steps to prevent, identify and mitigate them.

To start, management should be developing a comprehensive map of the organization’s supply chain to identify where critical data and systems components intersect with suppliers. This will provide insight into critical dependencies at vendors and help locate potential points of failure. From here, experts can home in on the pathways to a potential breach, identify areas where the organization is too dependent on a supplier or set of suppliers and diversify vendors where required.

Organizations may also need to revisit how they profile third parties. Those using an annual or semi-annual checklist approach—a list of security measures and best practices that outlines how to protect their systems, data, and infrastructure from cyber threats—should consider a more thorough and continuous approach. This would help them fully understand whether the reported controls at the third party are actually in place and whether they meet the standards and expectations of the organization. Audit committees should encourage management to regularly examine whether the evaluation of third parties is being performed with suitable rigour.

Cyber threat actors are increasingly using AI to target and tailor their attacks and search for new vulnerabilities. They’re producing sophisticated deepfakes of images, videos and voice, using those to trick people into helping them. For example, users have been targeted by sophisticated AI generated emails and voice calls in an attempt to compromise their email accounts. Call centres at banks have also been targeted in an attempt to get customer information. These types of attacks are expected to increase considerably, so management will need to ensure they’re keeping up to date on the latest attack techniques and the many tools and services that are available to detect and mitigate them.

Sophisticated tools are needed to combat these attacks. While cyber threat actors are increasingly using AI, organizations are also applying AI to cyber defence. AI can sift through massive data sets in real time, derive actionable insights and be trained to take automatic defensive actions. It’s being used to improve incident detection, assess vulnerabilities, manage access and assess third-party risks. However, AI comes with its own set of risks and creates a new avenue of attack for threat actors.  Audit committees must ensure their organizations are using AI safely and securely and mitigating newly introduced privacy, reputational, regulatory and cyber security risks.

In our 2024 CEO Outlook, 80 per cent of Canadian CEOs agree that building a cybersecurity-focused culture is central to how they integrate AI in their organization.¹

AI must be specifically designed for the cyber security task being performed, and only high-quality data should be used to train the models. Robust data integrity and privacy protocols must be in place, and access to the data and algorithms must be controlled. Audit committees should question management on how they’re dealing with the unauthorized and ungoverned use of AI by individuals in the workplace and how they’re keeping track of and complying with the myriad evolving regulations governing AI. To develop secure AI applications, organizations will need to upskill or outsource, and so will audit committees tasked with ensuring management has appropriately evaluated AI security.