A company that struggles with cybersecurity is not truly adhering to the policies it diligently enforces — this was the argument presented by federal investigators to compliance leaders at this year’s SCCE Compliance & Ethics Institute, as reported by CCI’s Jennifer L. Gaskin.
Compliance officers often find themselves labeled as the internal enforcers of their organizations (or even worse). However, Josh Goldfoot, a deputy assistant attorney general in the DOJ’s Criminal Division, views them in a different light: as “advisers and architects who are developing systems that assist your organizations in following the law, acting ethically, and preventing issues.” This is why he urges them to prioritize a specific agenda item: cybersecurity.
“If your organization is poor at cybersecurity, then ultimately, is it really complying with any of the policies you aimed to enforce?” Goldfoot posed to attendees at SCCE’s 2026 Compliance & Ethics Institute in Orlando, marking the organization’s 25th annual event.
The urgency of this question is increasing as fraudsters are increasingly utilizing AI-driven tools to expand their reach and enhance their strategies. In 2025, the FBI’s Internet Crime Complaint Center recorded over 1 million complaints for the first time, a rise from approximately 860,000 the previous year, with losses nearing $21 billion.
The era when antivirus software was sufficient, even for companies that don’t perceive themselves as vulnerable, is over, Goldfoot stated.
“If you possess money and are connected to the internet, you are a target for sophisticated hacking groups,” he informed the gathered compliance leaders.
AI is diminishing the warning signs
Much of the increase highlighted in the FBI’s cybercrime statistics is being fueled by AI, according to Jason Cromartie, special agent in charge of the FBI’s Cincinnati field office, who opened the general session on Monday. Phishing continues to be a primary method for attackers to infiltrate networks, and generative AI tools have made these messages appear more advanced than in previous years. Poor grammar and spelling are no longer reliable indicators.
“These tools eliminate the traditional warning signs and enable attackers to exploit trust at an entirely new level,” Cromartie remarked.
Deepfakes are becoming increasingly realistic, and voice cloning is on the rise. Cromartie recounted an FBI investigation involving a Fortune 500 company that lost $1 million after an employee acted on a cloned voicemail from the CFO, who was managing a merger at that time.
The next frontier is agentic AI, he noted. AI agents can search for information, select targets, create convincing personas, and attempt exploitation continuously, making attacks more difficult to detect and thwart.
“We are all trying to keep pace with the rapid advancements in technology,” Cromartie stated.
IBM’s 2025 annual report on the cost of a data breach indicated that approximately one in six data breaches involved attackers utilizing AI, most frequently through AI-generated phishing and deepfake impersonation attacks.
The role of compliance
While AI may be exacerbating the issue, it did not create the underlying cause, which often relates to the human factor. Organizations have spent years attempting to train their way out of this dilemma. Annual cybersecurity training modules and simulated phishing emails are standard practices across companies and organizations of various sizes and sectors.
Nevertheless, business email compromise ranks as the second most costly category in the FBI’s 2025 report, resulting in over $3 billion in losses. Additionally, IBM found that phishing was the most prevalent attack vector, accounting for 16% of all data breaches in their report.
“Humans do not always make the best decisions,” Cromartie stated. “Threat actors frequently exploit that as a vector.” And it doesn’t require much: “One individual, one click can lead to significant damage.”
For Goldfoot, this underscores that cybercrime is an ethics and compliance issue: “How are the interests you represent, the values and ethics you wish your organizations to uphold, impacted by the emerging cybercrime threat?” he inquired.
Source: Original article