Attackers Research Your Executives. Do It First.

Attackers research your executives before they ever send the first message. Most companies never run that same search on themselves.

A leader's name, title, assistant, travel, speaking dates, family details, and old passwords are often a few searches away. Put them together and an attacker has a script. They know who to call, who to impersonate, and which request will sound normal.

Voice cloning makes the script better. In May 2025 the FBI publicly warned that malicious actors were using texts and AI-generated voice messages to impersonate senior U.S. officials. The same trick works on a finance team that knows the CEO's voice.

Executive protection isn't only bodyguards and travel security. Start with the digital side, because it's the cheap part and the part most companies skip.

Step 1: Search your leaders like an attacker would

Pick your top five to ten people, plus anyone who can move money or approve access. Spend an hour on each one:

• Search their name with their email, phone, and home city.

• Check breach-notification services for their work and personal email addresses.

• Review data broker listings and start the opt-out process.

• Look at public posts for travel plans, family names, and photos of badges or home addresses.

• Find any video or audio clips online. Assume those clips can be used to clone a voice.

Write down what you found. That list is your threat picture. Get the person's consent first, and keep the results tightly held.

Step 2: Lock down the personal side

Attackers don't care that a personal account is outside your policy. They care that it leads to the same person. Offer your executives a short, voluntary checklist:

• A password manager, with unique passwords everywhere.

• Phishing-resistant MFA on personal email, banking, and cloud storage.

• A carrier account PIN and a port-out lock on their phone number.

• Automatic updates on phones, laptops, and home routers.

• A second look at what they and their family share publicly.

Make it easy. Sit down with them for thirty minutes and do it together. Busy people finish what someone walks them through.

Step 3: Make urgent requests prove themselves

Urgency is the attacker's favorite tool. So write the rules before anyone is under pressure:

1. Any request to move money, change bank details, or reset access gets a callback to a known number. Not the number in the message.

2. No executive is exempt. Say so out loud, from the top.

3. Assistants and finance staff have written permission to slow down and say no, even to the CEO.

4. Sensitive requests never move to a personal messaging app because someone asked.

5. Anyone who gets a strange call or message reports it, even if nothing happened.

Then test it. Run a short tabletop with the executive team and their assistants. Hand them a fake voice message from the CEO asking for a wire before end of day. See who calls back.

Tactical to practical

You can do all of this without buying anything this quarter:

• This week: name your high-risk people and get their consent.

• This month: run the search and start the opt-outs.

• This quarter: finish the personal checklist and run the tabletop.

• Every year: run it again. People change roles, and new data shows up.

Your executives are public by design. You can't hide them. You can decide what an attacker finds, and what happens when the call comes in.

If someone called your finance team today using your CEO's voice, what would stop the wire?

Views are my own.