A pair of long-ago Miami University roommates were the featured speakers at the Farmer School of Business Information Systems and Analytics (ISA) annual cybersecurity panel this month.

Tony Gayda serves as Senior Director and Head of Security for Chick-fil-A, while Eric Nadeau is Vice President of Finance for Tomorrow Sports, following a career as a five-time chief financial officer in commercial banking. The two were roommates at Miami 37 years ago.

Gayda and Nadeau warned that the modern threat landscape has escalated beyond simple computer viruses. The total global cost of cybercrime is projected to reach $10.5 trillion annually, a figure so staggering that, as Gayda noted, "if cybercrime was a country ... it would be the third largest country in the world in terms of gross domestic product," trailing only the United States and China.

The pair noted that the tactics used by threat actors have fundamentally shifted. While traditional ransomware focused on encrypting corporate files to demand a payout, today's attackers often don’t even bother with that.

"The trend right now is they'll just skip the whole extortion or the encryption, and they'll just go ahead and get in, take the data out, or at least a copy of it, and then just threaten to release it either on the dark web or to the media ... and just ask for money to not do that," Gayda explained.

Artificial intelligence has accelerated these attacks, Gayda said, acting as a "force multiplier for both the good guys and for the bad guys." Phishing campaigns are no longer obvious, poorly written emails or texts. He said that AI models can now create realistic, multi-month email chains using scraped public data, complete with authentic tone and verified names, to deceive finance departments into executing unauthorized wire transfers.

Gayda joked about where the rapid rise of autonomous attack scripts might lead: "Someday, is the cyber world going to be one where the good guys have their AI agents that are defending and the bad guys have their AI agents that are attacking, and it'll be just like a little digital battlefield and everyone's just going to sit back and watch the agents fight each other?"

For Nadeau, whose role involves safeguarding high-profile public figures, synthetic media and executive impersonation pose immediate reputational and financial dangers. Attackers can deploy AI agents designed to mirror corporate leaders to strike false deals with media vendors and partners.

At the same time, human behavior, specifically the so-called "Shadow AI," creates massive unseen risk, he said. Employees frequently paste confidential documents into open-source AI engines for convenience. "You upload 150 pages of tax [returns]. You get a great table that comes back,” Nadeau said. “It’s all spelled out for you. Your work is done, but now you've placed all that information into an unknown world.”

"The biggest thing in the whole cybersecurity chain is the one with the heartbeat. So, people doing something stupid is our biggest concern with AI," he said.

Even when a company's internal network is well designed and well run, vulnerability often lies within its vendor supply chain, the experts explained. Third- and fourth-party service providers can serve as digital backdoors, allowing attackers to move laterally across connected corporate networks. In banking, bad security practices at retail point-of-sale systems frequently leave financial institutions holding the bill.

"Where financial institutions differ from restaurants and commercial businesses is that we are the deepest pocket in the loss chain," Nadeau said. "Our exposure is the bad practices of our clients and our third and fourth parties."

To protect against vendor failures, institutions utilize complex contracts, indemnification clauses, independent audits, and continuous domain-scanning tools. But Nadeau noted that technical tools cannot always protect an organization from internal operational mistakes.

Nadeau recounted an example from his bank executive days where a loan officer’s laptop was stolen. The computer was recovered later that day, but when an IT manager attempted to deploy an automated remote-wipe script to sanitize the machine, he neglected to specify which computer should be wiped.

When staff logged in the following morning, Nadaeu said, every workstation checking in with the central management agent received the wipe command. More than 60 internal systems were erased before endpoint detection tools halted the loop.

"It turns out that we ransomware’d ourselves," Nadeau said. "The weakest link is the link with the heartbeat ... How you recover from that is almost more important sometimes than the infiltration of the event."

The men noted that when disasters occur, corporate cyber insurance policies are critical, yet securing coverage has become increasingly complex. Gayda said that preparing for annual insurance renewals involves pitching the strength of his company’s security posture directly to syndicate underwriters.

In addition, policyholders face shifting terms, such as "war clauses." "If there's a cyber-attack at your company and it can be attributed back to a nation state, then that's not a cyber event," Gayda noted. "That's an act of war, and therefore, you're not covered."

Beyond balance sheets and corporate risk, Nadeau urged the forum attendees to remember the human suffering behind global cybercrime, highlighting forced-labor scam compounds. Human trafficking networks deceive victims with fake job offers, then force them under threat of physical violence to conduct romance and extortion scams targeting Western citizens.

"We talk about what happens on this side, but there's a real human toll on the other side," Nadeau said.

For current students preparing to enter the workforce, both speakers emphasized that modern cybersecurity management requires much more than pure technical coding.

"Learn to talk the language of enterprise risk and not technology, as you talk about why I need a million dollars to put in new firewalls," Gayda advised. "Because it all becomes dollars and cents."

“Understand the business you're getting into. Much like you expect a business to have some understanding of IT security risk, also understand how you impact the company,” Nadeau said.

While the constant threat of attack carries a heavy psychological burden, Gayda encouraged students to embrace the challenge, sharing his "80/20" operational philosophy.

"Your perfect job should be one where 80 percent of your time you feel totally competent and totally prepared and just kind of acing the exam, but the other 20 percent of your time you should be scared to death," Gayda said. “I think it’s going to grow you, it's going to teach you, it's going to keep you engaged, it's going to keep you fired up, and so to me, the cybersecurity field is that perfect sweet spot.”