Cybersecurity requires organizations to balance protection with productivity. The objective is not to make every task more difficult. It is to establish practical safeguards that protect people, data, and operations without creating unnecessary barriers.
In this edition of Alliance Insights, John Dix, Head of Technology at the Risk & Insurance Education Alliance, breaks cybersecurity down into six areas that organizations can begin strengthening today.
1. Build Strong Security Basics
Technology alone cannot protect an organization. Employees must also understand how to recognize suspicious activity and feel comfortable reporting it.
John recommends short, frequent cybersecurity training supported by ongoing simulated phishing exercises. Just as importantly, organizations should “measure and coach” without assigning blame. When employees fear punishment, they may hesitate to report a mistake, allowing a potential incident to escalate.
Watch the video to learn how consistent training can turn employees into an active part of your cybersecurity strategy.
2. Recognize the Threats to Watch
Phishing, business email compromise, lookalike domains, fraudulent payment requests, credential theft, and multi-factor authentication fatigue remain serious concerns.
Threat actors continually test new ways to make malicious requests appear legitimate. John advises employees to slow down, verify unusual requests through a separate communication channel, and use saved links for frequently visited websites rather than relying exclusively on search results.
Watch the video for practical ways to identify suspicious requests before taking action.
3. Strengthen Network Security
Network segmentation can limit how far an attacker travels if one system or account is compromised. User environments, servers, production systems, and guest networks should be separated, with access granted only when there is a legitimate operational need.
John recommends a “deny by default” approach. Instead of leaving connections open, organizations should create specific permissions for the systems and people that require access.
Watch the video to see how network segmentation can reduce exposure across connected systems.
4. Establish Responsible AI Governance
Before employees use artificial intelligence, they need to know which tools are approved, what information those tools may access, and how AI-generated material should be reviewed.
John emphasizes that AI output “is always just the draft.” A qualified person should review content for accuracy, bias, privacy concerns, and regulatory exposure before it reaches a customer or influences code, finances, or policy.
Watch the video to explore how approved tools, documented processes, and human oversight support responsible AI use.
5. Prepare an Incident Response Plan
An effective incident response plan identifies who is responsible for detecting, containing, eradicating, and recovering from a cybersecurity event. The plan should be easy to access, stored securely, and supported by a simple reporting process.
After an incident, John recommends focusing on the failure that allowed the event to occur: “We’re going to fix the cause, not the symptom.” Tabletop exercises can then help employees understand the response process and reveal gaps before a real emergency.
Watch the video to learn how preparation and testing can improve an organization’s response when every minute matters.
6. Taking Action: The Next 90 Days
Organizations can make meaningful cybersecurity progress by dividing the work into three phases:
- Days 1–30: Inventory. Document assets, accounts, and AI tools; enable MFA wherever possible; and confirm that backups can be restored.
- Days 31–60: Harden. Address exposed remote access, establish patching expectations, segment critical systems, and publish security, AI use, business continuity, and incident response policies.
- Days 61–90: Monitor. Verify that logging and alerts work, launch awareness training and phishing simulations, and conduct an incident response tabletop exercise.
After the initial 90 days, the process begins again. Cybersecurity is not a one-time project. It is a continuing cycle of identifying gaps, strengthening defenses, monitoring results, and improving the organization’s response.
Watch the video to begin building a practical 90-day cybersecurity action plan.
Make Cybersecurity an Ongoing Business Practice!
Learn to identify first- and third-party cyber exposures, understand emerging cyber risks, and recognize when Cyber insurance coverage is needed. Enroll in the Cyber Exposures & Coverages Self-Paced Course today.
