Don’t Get Crypto-Locked: How CEOs Can Protect Their Business Against Cybercrime
In 2013, Russian hackers stole billions of personal data from Yahoo accounts in what remains the world’s largest data breach ever recorded.
This data breach went undetected for three years.
Yahoo finally admitted to their security issues in 2016. The breach (and subsequent cover-up) nearly killed the business completely: A $117.5 million class-action lawsuit, a $35 million fine from the U.S. Securities and Exchange Commission, and a serious devaluation in the middle of acquisition negotiations with Verizon. After the breach went public, CEO Marissa Mayer lost her $12 million bonus and equity package and her General Counsel resigned.
When ransomware hits, it’s not the firewall that’s blamed—it’s the CEO. One cyberattack like this could be enough to squander years of trust you’ve built up with your customers and employees.
Here’s what top-performing CEOs need to know to protect their business:
A New Cybercrime Era Has Begun
Since the dot-com boom, cybersecurity has been part of any strong IT strategy. But no matter the progress that security firms make—a $100.4 billion market in 2025—data breaches and coordinated cyberattacks remain a major issue, one that shouldn’t be relegated to your CTO’s purview. In fact, hackers breached more than 6 billion records from over 2,000 publicly disclosed incidents in 2024, according to IT Governance.
IT firm Cisco notes three major types of attacks that dominate hacker playbooks:
- Information stealer: This malware can capture keystrokes or extract files, saved passwords, VPN credentials, crypto wallets, and more from infected computers.
- Trojan: Like the mythical Trojan horse, a Trojan virus mimics legitimate software that tricks someone into clicking a malicious link or attachment that quickly spreads across the corporate network.
- Ransomware: This occurs when hackers gain access to your systems and lock you out of them, threatening to release sensitive information and demanding a fee (“ransom”) for decryption.
While these three attacks are the most often used, they’re not the only kind of threats your business faces. Remote-access Trojans (RAT), Advanced Persistent Threats (APT), Botnet, Dropper, and Backdoor hacks are all techniques cybercriminals use to get access to your business data.
What CEOs Should Own in the Fight Against Cybercrime
1. Following Common-Sense Computer Safety
Before panicking about the state of your cyberdefenses, look at your existing company culture. For years, the dominant growth mindset at many companies has been all about speed. But in doing so, are you accidentally cutting corners that could open your business for risk?
That includes:
- No shared passwords. Use password-sharing technology and make sure you’re paying for the seats you need for your tech stack. Every login should be protected with multi-factor authentication and password rotation. Implement access controls for any remote workers, like an encrypted VPN.
- Document and back-up your work. You (and your team) should make sure to back-up important documents and workflows on their own devices, and your IT team should have a backup of the entire product or system off-network just in case.
- Use a consistent process for deploying new code. Your engineering and product teams probably already have a process for how new code gets out the door, with a segmented protocol to add speed bumps into your network. Make sure you’re not sacrificing QA and security by pushing your team to ship first and ask questions later.
Your team takes cues from you. They may need permission to take the time it takes to be detail-oriented with the code base or to back up and organize their important documents. The more you can stress that security is a priority—not just intellectually, but in the way you operate—the stronger your security posture will be across the entire organization.
2. Planning for People to Click
Creating a security culture starts with acknowledging that we’re all human. Hackers employ sophisticated methods that are designed for people to fall for them.
While you should certainly invest in cybersecurity training and get your whole team up to speed on some of the common-sense measures above, know that falling for a phishing scam happens to the best of us.
Example phishing emails deployed by scammers
One way to stress test your team? Regular phishing tests sent by IT. The percentage of your internal team that fails this test is a good indicator of whether or not you need more training (and a stronger filtering setting for your company email provider.)
3. Creating an Action Plan for Security Breaches
Who is your first call when you receive a ransomware demand or find out about a massive data breach for your clients? Based on your cybersecurity insurance, set a threshold of risk. If you receive a demand over that amount, it’s time to call in legal, PR, insurance, and if serious, the authorities. Talk through the exact plan if these worst-case scenarios occur so you’re ready.
A strong security plan starts with monitoring these metrics:
- Backup recovery time from your last full test
- % of multi-factor authentication coverage for privileged and remote access
- Median patching time for critical vulnerabilities
- Mean time to detect and contain suspicious activity
This also includes addressing your tech debt and security patches throughout your product release cycle so that you’re not neglecting security holes because of arbitrary release deadlines for new products and features. These software patches may not be as sexy for the board or your shareholders, but they’re just as important to include in the cadence of your product roadmap.
You Don’t Have to Be a Cybersecurity Expert—But You Should Be a Leader
You may not have an engineering or security background, but you don’t have to. That’s exactly why you hire a great CTO. But that doesn’t mean you can forget about security altogether. As CEO, you’re responsible for making sure your team has what they need to protect your business, whether that’s hiring enough back-end engineers to manage cybersecurity elements, adding a multi-layered cyberdefense software into your tech stack, or in holding your team accountable against security protocols designed to protect the business you’ve worked so hard to build.
If you don’t have a coach and want one to help you prepare your business during this quickly evolving landscape, fill out the form below to take us up on a complimentary 1:1 coaching call.
Connect With a Coach:
About CEO Coaching International
CEO Coaching International works with CEOs and their leadership teams to achieve extraordinary results quarter after quarter, year after year. Known globally for its success in coaching growth-focused entrepreneurs to meaningful exits, the firm has coached more than 1,500+ CEOs and entrepreneurs across 100+ industries and 60 countries. Its coaches—former CEOs, presidents, and executives—have led businesses ranging from startups to over $10 billion, driving double-digit sales and profit growth, many culminating in eight, nine, or ten-figure exits.
Companies that have worked with CEO Coaching International for two years or more have achieved an average revenue CAGR of 25.9%, nearly 3X the U.S. average, and an average EBITDA CAGR of 39.2%, more than 4X the national benchmark.
Discover how coaching can transform your leadership journey at ceocoachinginternational.com.
Learn more about executive coaching | Meet our world-class coaches
