2023

Executive
Security
Spotlight
New research from Ivanti shows
real risks facing the C-suitePart of Ivanti’s Cybersecurity Status Report Series

Shutting down executive
cybersecurity threats
As a rule, organizations don't believe executive support blocks
cybersecurity excellence. In our inaugural Press Reset report,
only 21% of leaders and security professionals considered lackof executive buy-in as a security barrier — a full 16 points lower
than the most significant blocker, tech stack complexity (37%).

Yet, leadershipprofessionals are more
likely to practice unsafe
security behaviors thansecurity teams may havepreviously realized.

They’re 5x more likely to sayMore than 1 in 3 organizational

They’re 4x more likely

they’ve purposely obtained

leaders have clicked on ato share a company

unauthorized access to sensitive

phishing link — 4x the rate

password with someone

customer or company information.

of other office workers.

outside the organization.

How do you protect top executives — the most targeted groupof employees — when they say they buy in to your organization's
mandate, but frequently bypass security protocols?

Executive Security Spotlight2

This report highlights:

Security leaders already know that high-powered, high-accessindividuals present a unique security threat. Rather, Ivanti’s
newest research underscores the scale of the problem, andsuggests those executive security exceptions lead to outsized

The sizable gap between executives' stated priorities

organizational risks.

(e.g., buying into security policies) and their on-the-job actions.

How executives' security habits pose a substantially higher risk forcyberattacks and breaches than those of the general office population.

The current distrust between executives and the teams responsible forsecuring them — which may drive executives to external IT support, rather
than request internal help.

Practical ways to secure your organization with quiet, behind-the-scenes
implementations — all while you and your team restore the mutual trust"It may be tempting to excuse executives
from stringent cybersecurity measures dueto their limited numbers, underestimating
the potential threat they pose.
“However, recent research findings dispel
such misconceptions. Executives exhibit
distinct behaviors within the workplace, andenjoy unparalleled access and influence.
“This research unequivocallydemonstrates the imperative needto address and rectify their habits
and behaviors.”
Giuliano Liguori,
CEO of Kenovy

needed to truly secure executive buy-in of your security program.

Executive Security Spotlight3

Inside:01

The Executive Conduct Gap:
What They Say and What They Do

Methodology
Ivanti surveyed over 6,500 executive leaders,

In this report, we focus on C-level executives

cybersecurity professionals and office— and the attitudes and behaviors that makeworkers in Q4-2022 to understand today’s

them security dangers.

threats and discover how organizations arepreparing for yet-unknown future threats.

02

Outsized Executive Risks
to Organizations
Netherlands

10%

UK

03

04

Security Friction:
Executives’ Relationship with Security

Take Action:
Closing the Conduct Gap

China

10%
Germany

9%

10%

US

21%

France

10%

Japan

10%

India

10%

Australia

This document is provided strictly as a guide. No guarantees can

10%

be provided or expected. This document contains the confidential
information and/or proprietary property of Ivanti, Inc. and its affiliates(referred to collectively as “Ivanti”) and may not be disclosed or copied
without prior written consent of Ivanti.
Ivanti retains the right to make changes to this document or related
product specifications and descriptions, at any time, without notice.
Ivanti makes no warranty for the use of this document and assumes noresponsibility for any errors that can appear in the document, nor does

Officeworkers

Security
professionals

Leadershipexecutives

5,202

902

454

it make a commitment to update the information contained herein. For
the most current product information, please visit ivanti.com

Executive Security Spotlight4

01

The Executive Conduct Gap:
The difference between what leaders say about security…
and what they tend to doProblem Today

There’s a wide gap between what executives say and what they do.
Executives say they’re bullish about cybersecurity; nearly all claim to be supportive of their organization’s security mandate.
Yet, our research shows a large gap between what leaders say versus what they practice — something we call the Conduct Gap.

The Conduct Gap: executives’ beliefs versus behaviors

What leaders SAY:

Security
CultureWhat leaders DO:

96% of leaders say executives are at least moderately supportive of

49% of CXOs have requested to bypass

or invested in their organization’s cybersecurity mandate.

one or more security measures in the past year.

77% use easy-to-remember password hacks,
such as including birthdates or pet names.

Training

78% say their organizations provide mandatory cybersecurity training.

And, executives are 3x more likely to share work devices withunauthorized users, such as friends, families and external freelancers.

Phishing

88% of executives say they’re prepared to recognize

Of those who have been targeted by phishing,

and report threats like malware and phishing.

35% admit to clicking on the link — or even sending money.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

6

Whether due to a lack of time to go through proper channels, a senseof exceptionalism ("the rules can't apply to me"), or some other factor,
executives simply tend to behave differently — read: riskier — than any
other office workers.

24%
Executives who say they did not change the original
password for work applications issued to themduring onboarding.

14%
Frontline office workers who also don’t change theoriginal password.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

7

Why It Matters

Q:

Far from harmlessworkarounds, executive
behaviors pose aserious threat
Most seasoned security professionals know that risky
executive behaviors exist, but they often put off addressing
executive cyber hygiene in favor of other strategic priorities.
Security leaders must use their limited time and resources

Which of these pose a high security risk at your organization?
Note: Security professional respondents could select multiple options.

52%

Unauthorized access to data

47%

Unsecured devices
Sharing devices withunauthorized users

44%

Unauthorized tools / apps

43%

Unauthorized devices

42%

in a way that protects the organization from the most likely,
dangerous risks. So, the logic goes, why should security

7%

None of the above

teams spend additional time safeguarding leaders who
say they've bought into the program — and even secured0%budget for that program?

10%

20%

30%

40%

50%

60%

Ivanti's research confirms that not only is executive
security a problem, it’s also a systemic issue that afflicts
most organizations.
In fact, the very same factors security pros cited as posing
a high security risk to their organizations directly
correspond to the self-admitted executive habits.

1 in 3 executives

Executives are 3x

admit to accessing unauthorized
work files and data.

more likely to share work devices
with family and friends thanother office workers.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

8

Power dynamics playa role in executive
security behaviors

Why security teams struggle to impact executive behavior
Burnout
CISOs are overburdened and burned out. 60% of CISOs say they haveexperienced burnout in the last 12 months, and 61% say there are excessive

Unfortunately, the unequal power dynamic between
security teams and top executives exacerbates the problem.

expectations for CISOs/CSOs.1

How often have security professionals tried

Cultureto implement best-practice security policies,

When the boss (or the boss's boss) asks for a favor or workaround

only to face open complaints and shadow IT

against protocol, security employees are understandably uncomfortableworkarounds from the same frontline users

pushing back.

they're trying to protect?

Without a strong security-first culture, employees and security pros might
simply defer to an authority's unsafe request.

How can security teams be expected to enforce
better cyber hygiene and security practices by
the same executives who approve their budgets— and their jobs — in an uncertain job market?

Just-this-once-ism
There is a real appeal to the “just this once” or “just for you” rationalization.
In the moment, security pros may feel embarrassed to enforce rules with
the CEO — especially if exceptions have been granted in the past.

Due to limited bandwidth, exhaustion and burnout, security
professionals often relent to pressure from executives.

"Just this once" is almost never just once, compounding the risk of executive
workarounds and setting a precedent that's hard to walk back.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

9

02

Outsized Executive Risks
to Organizations:
The impact of executives' bad security
habits on their cybersecurity

Problem Today

Risky executive behaviors have outsized consequences
Though few in number, executives possess an exceptional degree of automatic access as well as some concerning security behaviors;these pose a far greater security risk to their organizations than do office workers.

Unprotected first-degree executive connections

45% of leaders

Nearly 1 in 5

let family and friends use work
devices at least monthly.

leaders have shared their work password
with someone outside the company.

!

That’s 3x the rate of all other office workers!

These first-degree associations are not trained in security, nor invested in keeping your organization
safe — even as they’re using your organization’s devices with in-depth file and network access.
Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

11Unauthorized executive access

Q:

More than 1 in 3 leaders (34%) admit they’ve accessed unauthorized information at work.
And, nearly 2 in 3 say that they could have edited those files/data when accessing them.

Q:

What files did you access?
15%

Strategic files

40%
39%

Customer data
18%

Financials

36%
24%

Employee records or reviews

Salary or payroll records

33%

23%

0%

25%

10%

20%

30%

Office Workers (n=648)

26%

Documenting fraud or
unethical behavior

5%

27%

7%

32%

22%

The file or data was
accidentally shared with me

26%

9%

Prospect lists

4%

Curiosity

29%

18%

Proprietary company information

Copying files before resigningor getting fired

Proving security flaw(s)

34%

20%

Private communications

44%

Why did you access unauthorized information?

34%

29%

39%

44%

I opened the file by accident

40%

50%

0%

Leadership (n=154)

10%

20%

Office Workers (n=648)

30%

40%

51%

50%

Leadership (n=154)

Note: For each graph, all respondents previously confirmed they accessed files not needed for their roles.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

12Why It Matters

Executive security exceptions
lead to elevated risks

Q:

Who have you shared your password with?

Many executives cut corners to save time or inconvenience. However,Ivanti's research shows the risk is more systemic than previously understood.

43%

Spouse or partner

37%

Executives reasonably believe their time is precious and limited.
Sharing passwords and devices with family, colleagues and third-party techsupport, for example, may be viewed as a low-risk time-saver.

27%

24%

Freelancer who helps
me do my job

8%

24%

Children

Executive respondents who say
they let friends/family use theirwork devices at least monthly— compared to just 6% of otheroffice workers who say the same.

12%

6%

None of the above

18%
0%

10%

20%

30%

40%

50%

Leadership (n=93)
Office Workers (n=308)

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

13Threat actors — whether they’re financiallymotivated ransomware gangs or advanced
persistent threats (APTs) — explicitly target
high-level executives because they are

Executives at higher phishing risk than office workers

super-connected to valuable data sources
and networked assets, while simultaneously

Executives

Risks

less vigilant about their cyber hygiene habits.

Office Workers

After all, why cast a wide net for an average
office worker’s permissions, when a single“whale” grants exceptional access to more

47%

35%

Known phishingtarget in the last
12 months

Clicked on aphishing link orsent money

valuable assets?

33%"There's a 100% chanceyour organization has beenphished in the last year.
It's the #1 way threat actors
get that initial foothold inyour network.

8%

These higher rates may be due to an uptick in tailored-for-whales spearphishing attacks. It’s worth the extra timeand effort for attackers to target whales due to their access and privileges.

“We need to make sure that
we account for that, and don't
just assume people will 'know
better' or that a phish will beoverly obvious."
Daniel Spicer
Chief Security Officer at Ivanti

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

14

Real-World Repercussions

Leadership turnover offers
ideal phishing conditions
In 2015, Mattel fell victim to a highly publicized spearphishing event,losing $3 million to cybercriminals based in China.
A subsequent case study by Infosec2 found that Mattel’s decision tohire a new CEO created a scenario ripe for exploitation:“They waited for the perfect moment, which came when
Mattel decided to appoint a new CEO, Christopher Sinclair,
to replace Bryan Stockton in January 2015. The arrival of the
new CEO implied changes within higher management which
would cause new power struggles in the corporate hierarchy.
“In other words, the cybercriminals even took into
consideration the office politics and human relationshipsof Mattel to plan their whaling email.”
Infosec case study2

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

15

03

Security Friction:
Exploring executives’ tense relationshipwith their security teams

Problem Today

Executives’ security experiencescompound bad cyber hygiene

Ivanti’s research shows executives are 2.5x more likely to reach out to security than
the average employee — a good sign — but they are also significantly more likely todescribe their interactions as negative.

Leaders are:

2X

4X

33%

more likely to say theirpast interactions withsecurity were awkward

more likely to use
external, unapproved
tech support

more likely to not feelsafe reporting security
mistakes like clicking ona phishing link. (That's
over 1 in 10 leaders!)"It’s unequivocal that data
breaches rank as top executive
concerns. For robust protection,
executives must now harness
AI’s prowess in real-timethreat detection to fortify
organizational assets."
Ronald van Loon
CEO, Principal Analyst at Intelligent World

2X

5X

more likely to say
those interactions felt
embarrassing

more likely toshare a work password
with someone outside
the organization

How can organizations lower
communication barriers
between executives — who
may feel awkward reporting
errors — and the security
teams trying to protect them?

Note: These statistics compare executive-level employees with all other office workers.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

17

Why It Matters

Organizations need a robust
executive cybersecurity program
Executives' workarounds are driving serious security vulnerabilities,
but underlying these is a company culture that tolerates executive
exceptionalism and makes reporting mistakes less likely.
Security teams must prioritize rebuilding that trust and buy-in withexecutives from a place of honesty and friendly support— not condemnation or condescension.

Top executives
support a security culture byunderstanding cybersecurity’s
strategic role inside the organizationand visibly championing its efforts.

Security teams
support a security culture by
maintaining an open communicationstyle that aims to educate (not punish
or shame) people who make errors.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

18

Mitigating executive
security risks iseven more urgent
during layoffs

Ivanti’s research shows credential deprovisioning

The risk posed by zombie credentials is even higher

is a problem across the board, as security

during periods of layoffs — when employees are more

professionals tell us that deprovisioning guidance islikely to take data with them, or hold a grudge against

ignored a third of the time — a stunning admission,a former employer.

given the exposure involved.

Jeff Pollard, a Forrester analyst, supports thisAnd, 26% of all executives surveyed say they still haveconclusion: “We know that layoffs or job losses areusable passwords from a previous job — somethinga predictor of insider risks, making it more likely for

we call zombie credentials.

security events to occur. We have seen over the years
that this has happened.”326%“It used to be hard [to pull off
an inside job]; now it’s easy.
In the past, you could takewhat you could carry in yourbriefcase. Today you can carryout terabytes.”of executives
surveyed say they
still have usablepasswords from aprevious job

Pete Nicoletti
Field CISO for the Americas
at Check Point Software3

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

19

04

Take Action:
Closing the Executive Conduct Gap
at your organization

Take Action

Shine an uncompromising light on the problem
Ivanti’s research confirms what many of us have known for a long time: executives represent a unique andsignificant threat to an organization's security position. Now, with data in hand, it’s time to address the problem.

1

2

3

"You have to build a culture— I say that like it's easy, but it'strue — where you can challenge
leadership and build a processthat everyone's accountable to."AJ NashVP and Distinguished Fellow of Intelligence at ZeroFox

Conduct audits
to assess your current executive conduct gaps.

20%

Fix the easiest and least-obtrusive risks first,of global data breaches can be linked toof global data breaches can be linked to

avoiding direct conflicts with leadership when it’s unnecessary.

3
insider
insiderattacks.
attacks.3

Gamify tabletop exercises,
forcing executives to connect the dots between basic cyber hygiene
and a future breach’s impact on their departments themselves.

4

Implement a "white glove" security program.

Did you know?

Even if you have many more general office workers than leadership-level employees,
personal attention to this smaller stakeholder community offers a big return for yourC-level executives are 6.5x more likely to copy

limited resource investment.

files before resigning or getting fired, comparedto other knowledge workers.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action21

1

Conduct an audit.

To get up to date on executive-employee behaviors inside yourorganization, consider an audit. The goal here is not to punish or shame,
but to ensure security governance policies apply to all personnel,
regardless of position.

Internal audit

External audit

Take inventory of your security team’s interactions with executives

Consider hiring an external auditor for an executive risk

(director level and above) over the last 12 months, looking for patterns

assessment, too.

of miscommunication and risky behaviors — both from executives andsecurity team members.

When a company is considering changing executive privileges or
imposing greater controls on top management, it’s always a goodFor example, pull a random sample of call recordings and archived
ticket messages. Review these looking for cues related to tone andword choice by both parties.

idea to get an outside perspective.
An external auditor can oversee an impartial executive risk
assessment and – if required – deliver bad news to the leadership

Did the exchange:

team and board.

■ Cause embarrassment over a silly error?
■ Inspire fear due to consequences of an oversight?
■ Alienate or frustrate either party?

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

22

Real-World Repercussions

Internal policy saves school from$100,000 phishing scam4
Dr. Jan McGee, the former principal of a Florida charter school, wrote a$100,000 check out of the school's account after corresponding for months
with an individual she thought was billionaire Elon Musk or his representative.
Dr. McGee only had authorization to write a check up to $50,000 of school
funds without board approval. Luckily, the school’s business manager
Brent Appy managed to cancel the check before the scammers could clear it.

“I am a very smart lady. Well-educated. I fell for a scam.
“Grooming is when you talk to somebody and you
believe in them, and they get you to trust them that thisis really real, and so I fell for it.”Dr. Jan McGee
Ex-principal of Florida charter school

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action23

2

Fix the easiest and least-obtrusive executive risks first.

Some of the easiest items might include:

Establishing and updating your data sensitivity and classification policy: who is allowed to haveWith an audit completed and abetter sense of your security

access to what, in what circumstances and for how long — along with why certain permissions aren't
allowed. Make it transparent and obvious to everyone what's allowed and what's not, and why.

vulnerabilities, it’s time to makean action plan — and do so in a
way that is not overly obtrusive.

Updating internal communication strategies to introduce acceptable use policies (AUPs) and data
sensitivity policies at every employee’s initial onboarding, as well as regular reminders. You can't counton a single “official” policy document on your organization's intranet to educate your entire internal
stakeholder population — especially not busy executives!

Documenting and implementing standard access approval and fulfillment procedures to guaranteethat access control policies are applied to all personnel, and that all activities are fully documented andverifiable. (If your audit couldn't confirm access or network activity, then it's time to make sure it can!)Identify the most common breachor exposure in your organization
based on your executive conduct
gap audits, and prioritize that for
remediation first.

Considering your executives’ current digital employee experience (DEX). Punitive or inhibitive security
measures that interfere with executives’ regular workflow add to feelings of distrust. Instead, choose
security tools that run silently behind the scenes, providing security to executives without inviting excessive
questions and/or tickets complaining about frequent lockouts.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action24

3

Gamify executive table-top exercises.

Gamified security training sessions explicitly for non-technical leadershipcan win greater executive buy-in. These sessions help participants discoverdepartment-level impacts of security breaches for themselves – with security
to point them in the right direction.

Consider starting small with
"Spot the Phish."You can start your next executive meeting with a simple
round of "Spot the Phish," in which you show your teamsample phishing messages and ask the group which was real
and which was a phish.
It takes two slides and less than three minutes for this simple,
interactive game featuring real cyberattacks!

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action25

Gamified security training tips for executives

Keep it short

Add random chance

Be creative

Try shorter and more frequent

Randomize your session threats

Encourage your executives

Play on theSame teampeople-led sessions – in-personand scenarios. It could be as

to come up with creative

Never name current or former

or remotely – instead of half- or

simple a rolling a 20-sided die

solutions to block an attack or

employees as risks or threats,

day-long workshops. Spend fiveto pick a risk from a numbered

ways to exploit the risks to theeven in pretend exercises! Keepminutes at the start of recurring

list, or as complex as apresented scenarios; don’t bog

both executives and security

executive leadership meetings forgenerator weighted for the mostdown a session by explaining

team members working on thea quick security game or session!

realistic risks to your specific

why an idea is unrealistic,

same side, so everyone eitherorganization, region or industry.

impractical or inaccurate.

succeeds or fails as a group.

Act it out

Retrofit board games

Offer prizes

Set up pre-made security

Purchase a used board gameAward the best and most

Avoid utilizing
complex vernaculartraining boxes of various

like “Shoots and Ladders,”

creative participants with

Avoid security jargon andscenarios, materials, props,“Life,” or “Monopoly”

company swag!

acronyms, as well as eventools or even toy bricks tofor an easily retrofitted

veiled remarks on current

speed up training exercises

security-game-in-a-box.

executive security habits.

while including uniqueand creative engagement
opportunities.5

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action

26

Use real-world case studies during exercises toconnect the dots.
Security leaders should also highlight how malicious attacks impact personal lives and careers throughincident case studies within a similar industry, executive role or risk profile. Remember to find both goodand bad reactions!

Example case study: Levitas Capital⁶

The incident:

What went wrong:

What happened after:

In 2020, a founder at Levitas
Capital clicked on a spoofed
Zoom link that installed malware
on the organization’s network.
The attackers stole $800,000
before the ruse was discovered.

In short? The normal channels
for approving financial transfers
broke down; attackers gained
control of the company’s
email system; and they twice
impersonated a fund co-founder
to a third-party administrator.

Levitas’s biggest client lost
confidence and walked away,
and the hedge fund closed twomonths after the event — a very
public comedown for the fund’s
two founders, Michael Brookes andMichael Fagan.

“There were so many red flags which should have been spotted."Michael Fagan
Co-founder at Levitas Capital

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action27

4

Consider implementing a“white glove security service” for executives.

Due to their higher profile and access, high-level
executives deserve individual attention from security teams:
a “white glove security service,” in a manner of speaking.
Given that leaders are twice as likely to say their interactions withsecurity are awkward — and four times more likely to seek outsidetech support — the goal of such a program is to build trust andlower barriers to reporting security errors or questions.

When creating
your “white glove”
security program,consider:Enforcing deprovisioning
policies through automation,

Assigning a single point of contact –not your top-most security leader! – for highlevel executives. This helps build trust while
consolidating and standardizing communication.

including manual off-boarding checks to
avoid zombie credentials.

Rethinking onboarding for leadership-level employees,
including custom access permissions and personal password manager
set-up. Leaders themselves may not have time to follow step-by-step
instructions for proper configurations, but your organization can’t afford
for its executives to go without these basic guardrails.

Developing one-on-one personal security training
that's not a generic presentation executives can skip through.
Use previous tabletop exercises and select case studies which
focus on incidents similar to the new executive’s department or role.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action28

No matter the actions taken, your team’s focus should be on instilling a positive— not punitive — security culture, and winning greater executive compliancethrough compelling education and collaborative insights.

Access Ivanti's cybersecurity
research and report series!

As this report’s own cited case studies prove: human errors happen.
They will happen to your organization. They’re inevitable, and impossible
to avoid entirely.
However, only organizations with true executive buy-in will be able to restore
systems and confidence, navigating forward beyond the breach.

Executive Security Spotlight

Executive Conduct Gap

Outsized Executive Risks

Security Friction

Take Action29

References
1. Proofpoint. (2022, May). 2022 Voice of the CISO: Global Insights Into CISO
Challenges, Expectations and Priorities. From Proofpoint: https://go.proofpoint.
com/en-voice-of-the-ciso-2022.html
2. Yip, K. N. (2016, May 21). Whaling Case Study: Mattel's $3 Million Phishing
Adventure. From Infosec: https://resources.infosecinstitute.com/topic/whalingcase-study/
3. Pratt, M. K. (2023, February 28). Economic pressures are increasing
cybersecurity risks; a recession would amp them up more. From CSO Online:
https://www.csoonline.com/article/3689008/economic-pressures-are-increasingcybersecurity-risks-a-recession-would-amp-them-up-more.html
4. Metz, C. (2023, March 29). Florida principal resigns after sending $100K to
scammer posing as Elon Musk. From CBS News Miami: https://www.cbsnews.
com/miami/news/florida-principal-resigns-after-sending-100k-to-scammerposing-as-elon-musk/
5. Garzón, G., & Garzón, F. (2020, June 30). Cybersecurity Incident Response:
Tabletop Exercises Using the Lego Serious Play Method. From ISACA:
https://www.isaca.org/resources/isaca-journal/issues/2020/volume-4/
cybersecurity-incident-response
6. SecureWorld News Team. (2020, November 23). Hedge Fund Closes Down
After Cyber Attack. From SecureWorld: https://www.secureworld.io/industrynews/hedge-fund-closes-after-bec-cyber-attac

Executive Security Spotlight30

2023 Executive Security Spotlight
New research from Ivanti shows the real risksfacing the C-suite

ivanti.com
1 800 982 2130
sales@ivanti.com

Part of Ivanti’s Cybersecurity Status Report Series

Copyright © 2023, Ivanti. All rights reserved. IVI-2773 AS/KF