The Baruch Group

10/15/2026

Cyber: how to respond to a ransomware attack
Author: ICAEW Insights
Published: 15 Oct 2026
https://buff.ly/y8mqEnc
Almost half of all cyber attacks involve ransomware, a technology fast evolving into a far more dangerous threat to companies’ networks, with many underprepared for an attack. What are the critical steps businesses should take after a ransomware attack?
Key takeaways

Ransomware prevalence: Nearly half of all cyber attacks (48%) involve ransomware, according to Verizon’s 2026 Data Breach Investigations Report (DBIR).
Evolving ransomware attacks: Ransomware attacks are evolving according to threat intelligence experts, incorporating 'Trojan Horse' tactics to mask secondary network breaches.
Cyber incident response plan numbers: Only 25% of UK businesses and 19% of charities have an ‘incident response plan’ in place, according to the government’s 2025/2026 Cyber Security Breaches Survey.
Much has changed since the high-profile ‘Wannacry’ ransomware cyber attack of 2017, which locked a third of NHS trusts out of their devices, forced the cancellation of 19,000 medical appointments, all at a total cost of £92m to the British taxpayer.

Wannacry infected up to 200,000 computers across more than 150 countries worldwide, by targeting unsupported and unpatched networks running the Microsoft Windows XP operating system.

Nearly a decade on, ransomware attacks are more polished, and often offered as part of ‘crime as a service’ packages. In mid-August, a ransomware attack against online banking platform Revolut, resulted in the theft of thousands of customers’ data.

IBM’s latest X-Force Threat Intelligence Index says the number of ransomware operators has almost doubled (49%) compared to a year ago. According to research by Verizon, nearly half of all cyber attacks (48%) involve ransomware-led breaches. And, as low barriers to entry and AI augmentation drive demand, the crime itself is evolving into something far more damaging.

Phil Osgathorpe, director and head of Cyber and IT Assurance at PFK Francis Clark chartered accountants, tells the story of a company targeted with what, at surface level, looked like just a ransomware attack but acted almost like a ‘Trojan horse’, masking a different, concurrent cyber breach altogether.

“On the face of it, it looked like a ransomware hack, when what was actually happening underneath were more subtle behaviours of installation or monitoring of other things on their network, systems and devices, all going on under the radar,” he says.

To pay, or not to pay?
Last year the government announced plans to ban public sector and critical infrastructure organisations from paying ransoms, making them less attractive to hackers if no post-attack b***y is forthcoming. For private sector corporations, it’s less clear-cut.

Tristan Hodgson, Director of Cyber Risk Services at Mitigo Group notes that paying ransom is not illegal in the UK, but highly discouraged, as it never guarantees network or data restoration. Large firms may have "ransom budgets" in their crisis plans, whereas SMEs often lack the financial resilience, “making an attack potentially existential”, he says.

Smaller organisations may assume that they can recoup ransom payments through their cyber insurance policy. However, not all policies cover these payments, and many providers are limiting coverage due to the high cost of ransoms.

How to respond
Regardless of whether your company intends to pay up or not, there are a number of ‘non-negotiable’ actions you can take in response to a ransomware attack: having a pre-arranged incident response plan is paramount.

Shockingly, given the rising frequency of cyberattacks, a mere 25% of UK businesses and 19% of charities actually have a plan in place: of those, a significant proportion have never tested or rehearsed those plans, meaning that firms often foster a false sense of security about how prepared they actually are.

10/15/2026

Growth favors the bold: AI as force multiplier
August 6, 2026 |
https://buff.ly/8O4dNS1

Seven myths hamper growth in the new world of AI-driven growth. Overcoming them requires leaders to focus on redesigning how commercial decisions are made.

The race for growth has entered a new era. The companies pulling ahead recognize how deeply AI is changing the way they create demand, convert customers, and generate value. While every CEO wants to achieve above-market growth, early AI leaders are going bigger. They are achieving EBITDA uplifts of 20 percent or more by rewiring their commercial engines around AI, not simply deploying new technology.1

That value is not some theoretical aspiration. For example, Reckitt, a global leader in home and consumer health care, unlocked more than $500 million in new revenue with its ambitious growth transformation. The company used AI-powered simulations and scenario planning to improve commercial pricing, promotions, and assortment decisions as well as to guide field sales teams on which in-store merchandising activities to prioritize to create tangible value. In another case, DBS, the Singapore-based bank, has generated hundreds of millions of dollars in value by rewiring its business around AI.

Yet these companies remain the exceptions. Nearly 90 percent of companies regularly use AI in at least one business function, according to a global McKinsey survey, but just 37 percent of respondents attribute any level of EBIT impact to AI.2 Furthermore, the gap between leaders and laggards is growing. Our latest research shows that 60 percent of market leaders report double-digit revenue growth, compared with just 21 percent of laggards.3

To narrow the gap and turn AI into a force multiplier for growth, CEOs need to fundamentally rewire how they operate to move faster, more iteratively, and with clearer direction. That starts with rejecting the myths that can sink their growth aspirations.

Myths and realities about AI and growth
In our experience, we see seven common myths that can hamper business leaders’ ability to turn AI into value.

Myths that limit ambition
Myth: Above-market growth goals are enough.

Reality: AI raises the ceiling on how much growth is possible. While nearly 75 percent of companies set above-market growth targets, that’s not bold enough.4 Our research finds that leaders who set bold growth ambitions—underpinned by AI—can unlock nearly three times more value than they imagine.5

Myth: AI is primarily a productivity tool.

Reality: Some 80 percent of companies use AI to improve efficiency, but AI can do much more. The companies creating the greatest value are using AI to improve both efficiency and effectiveness.6 Greater effectiveness creates new demand, increases conversion, and accelerates growth and innovation.

Myths that preserve old ways of working
Myth: Layering AI onto existing processes drives growth.

Reality: Bolting AI onto existing processes—often resulting in a proliferation of isolated use cases—doesn’t lead to growth. Rather, it is activity without architecture. AI high performers are three times as likely to say their organizations have fundamentally redesigned individual workflows.7

Myth: The chief technology officer (CTO) should lead the AI transformation.

Reality: The approach associated with growth is to undertake a business transformation enabled by technology, with people at the center. That’s why leaders at half of top-performing companies co-create strategy across technology and business to redesign new pathways to growth.8

Myths that slow down value capture
Myth: Scaling AI is mostly a tech rollout.

Reality: Creating enterprise-wide growth involves more than new technology; it involves new ways of working, capabilities and skills, and governance models. Achieving this degree of change requires resources dedicated to change management. The rule of thumb is that for every $1 a company spends on an AI initiative, it needs another $3—and sometimes more—for change management.9

Myth: AI initiatives take a long time to create P&L value.

Reality: In our experience, AI leaders often see impact on leading indicators within weeks and create substantial economic value within three to six months. That happens when companies focus on high-value commercial workflows in priority domains and iterate rapidly.

Myth: Companies need perfect data in order to introduce AI.

Reality: Good data matters, but in our experience, 80 percent of companies do not need to build a data lake or rebuild their entire data architecture to get value. “Good enough” data is sufficient to start capturing value quickly.

Seven myths hamper growth in the new world of AI-driven growth. Overcoming them requires leaders to focus on redesigning how commercial decisions are made.

10/14/2026

The Clock Has Run Out on Traditional Cybersecurity
Opinion
9 October 2026
Written by
Photo of Julie Talbot-Hubbard
Julie Talbot-Hubbard
VP of Security Services, AHEAD
https://buff.ly/w8NambW

For years, cybersecurity followed a predictable pattern. A vulnerability appeared, security teams investigated it, a patch was eventually released, and organizations worked to close the gap before attackers could take advantage. That model was never perfect, but it was built for a world where change moved more slowly.

That world no longer exists. Artificial intelligence has changed the game for cyber-attacks. Finding a weakness, turning it into a weapon, and exploiting it can now occur in a single afternoon, hour or even minutes in the worst cases. The time between exposure and exploitation is shrinking rapidly. Many enterprise security programs still rely on assumptions meant for a much slower threat landscape.

This is not just about attackers gaining better tools. It's about an operating model that has run out of time. Security leaders don’t need another reminder that threats are evolving. They must realize that the old operating model based on periodic assessments, isolated technologies and manual processes can no longer keep up.

The organizations that adapt fastest will not necessarily be the ones with the most tools or the biggest budgets. They will be the ones with the clearest integrated model.

Continuous Visibility Beats Periodic Assessment
Traditional vulnerability management was designed for environments that changed slowly. Quarterly scans, annual pe*******on tests and scheduled compliance reviews produced meaningful insights because the underlying infrastructure itself remained relatively stable.

Today’s enterprises look completely different. Cloud resources can be created and removed within hours. Applications are updated constantly. Identities now span employees, contractors, workloads, APIs and increasingly AI agents acting on an organization’s behalf. A security posture that looks accurate on Monday can be outdated by Wednesday.

That's why vulnerability management must evolve into continuous exposure management. The goal isn’t to gather more vulnerability data. Most organizations already have plenty of that. The focus should be on understanding what is exploitable, identifying the most relevant attack paths and reducing exposure based on business risks, rather than simply processing another spreadsheet ranked by CVSS scores.

The work is also inherently cross-domain. Exposure management is far more effective when security works in concert with cloud, infrastructure, application and identity teams, instead of passing issues across departmental lines. In fast-paced environments, reducing remediation time matters much more than generating another report.

Identity Has Become the New Security Perimeter
The traditional network perimeter has largely disappeared. Hybrid work, multi-cloud setups, SaaS applications, and distributed infrastructure have fundamentally changed where trust begins and ends. Identity is now the most reliable control point organizations have.

That means enforcing least-privilege access consistently, verifying continuously, and applying segmentation and policy discipline across every human and non-human identity interacting with enterprise systems.

Agentic AI raises the stakes further. Autonomous agents are already gathering information, executing workflows, making decisions, and interacting with enterprise applications with limited human intervention, and most identity governance models were never built to handle it.

As organizations accelerate AI adoption, managing these machine identities with the same rigor as human users will require stronger governance, clearer accountability and consistent policy enforcement across identities, workflows and AI-enabled systems.

Security Operations Must Move at Machine Speed
The modern Security Operations Center (SOC) faces pressure from both sides. The number of alerts keeps rising, while finding skilled cybersecurity workers remains tough. Analysts waste time switching between disconnected tools, manually linking events and chasing false positives instead of addressing real threats.

This doesn’t mean replacing analysts with AI. It means using automation and AI-assisted investigation to handle repetitive tasks, so analysts can focus on where human judgment matters most.

Modern SOCs should automatically link telemetry across hybrid environments, speed up investigations with contextual analysis, and automate routine response actions when appropriate. The objective isn’t just faster alerts; it's about faster, better-informed decisions.

10/14/2026

The key to AI value is hiding in plain sight: Your operating model
September 9, 2026
https://buff.ly/n9102FM
New research shows that organizations undergoing AI transformation succeed not by adopting one “best” operating model, but by making intentional design choices and executing them effectively.
The biggest technology breakthroughs rarely deliver on their full potential. Value flows only when organizations redesign their operating models to capture the new technology’s promise.

AI, and agentic AI in particular, demands a fundamentally different operating model. It reshapes how decisions are made, how work is done across functions, how capabilities are developed, and where value is created. As organizations move from experimenting to reinventing work with AI, two questions are critical: Which operating model choices distinguish organizations that successfully create value from AI? And where should leaders focus their efforts to maximize the impact of those choices?

Our new research found that “reinventors”—organizations that are fundamentally reimagining how work gets done—are more likely to report stronger operating model performance than organizations in earlier stages of AI adoption (see sidebar “About the research”).

In this article, we discuss the operating model choices reinventors make and how well they execute those choices to capture tangible gains from AI. We also offer five lessons from this group that can help leaders maximize returns from their AI investments.

How AI maturity influences operating model performance
In both the prior AI readiness survey and in our new research, organizations fall into three “horizons” based on how deeply they embed AI in daily work. In the first horizon, enablement, organizations offer individual employees access to general-purpose AI tools that assist with aspects of their existing jobs. In the second, automation, companies automate and improve existing cross-functional workflows using AI at scale. In the third, reinvention, they reimagine how work gets done by redesigning roles, workflows, and the operating model to leverage AI’s full potential (Exhibit 1).

Organizations fall into three horizons of AI maturity.
Reinventors represent just 13 percent of this sample. However, the previous AI readiness research found that reinventors are significantly more likely to realize meaningful enterprise value than organizations in earlier horizons. Nearly half (48 percent) of leaders in the reinvention horizon reported capturing meaningful enterprise value from AI, compared with just 13 percent of leaders in the enablement horizon and 24 percent in the automation horizon.2

The reinventor advantage in operating model performance does not stem from adopting a single “best” operating model. Rather, it reflects a combination of different operating model choices and stronger, focused ex*****on.

High-performing operating models are best understood as dynamic systems of interconnected design choices. McKinsey’s Organize to Value research3 shows that organizations choose among 12 operating model elements, including structure, governance, processes, technology, leadership, talent, and rewards (table). The combination of these decisions—whether by refining several of the elements or shifting all 12—forms an organization’s unique operating model “fingerprint.”

10/13/2026

Sustainability Reporting Isn’t the Same as Risk Preparedness
by Christos Cabolis and Karl Schmedders
October 9, 2026
Henrik Sorensen/Getty Images
https://buff.ly/n7ufLed
Summary. Sustainability reporting has become widespread among large firms, but strong disclosure does not necessarily translate into preparedness for climate-related risks. This research identifies a critical divide between “surface strategists,” who use ESG reporting for compliance and communication, and “leading adapters,” who use it to drive operational decisions. Drawing on examples from global companies, the article highlights five practices that distinguish prepared organizations: using scenarios to change strategy, mapping risks to specific operational failure points, embedding carbon pricing into financial decisions, tying incentives to measurable outcomes, and ensuring accountable governance. The key insight is that ESG reporting only reduces risk when it builds internal capability. Without that shift, even companies with high-quality disclosures remain exposed to unexpected shocks.

Sustainability reporting is now common among large companies. According to the OECD, firms representing 91% of global listed market capitalization disclose sustainability-related information.

Yet we find that firms with strong reporting often assume this translates to operational preparedness. It does not. A polished disclosure alone can’t protect against a record flood that shuts down the sole supplier of a critical component, a heatwave that forces rolling shutdowns at a flagship plant, or an abrupt jump in carbon prices that can turn a profitable product line into a loss-maker overnight.

This finding builds on our published research into how companies respond to climate-related demands, from EU carbon markets and ESG reporting standards to the costs of cutting emissions. It also reflects our executive education work at IMD, where we work with senior leaders on climate strategy across industries.

Early in this research we mapped companies along two dimensions: the quality of their disclosure and the strength of their underlying risk management. Four postures emerged, including firms blind to risks they never examined and firms that manage risk well without also disclosing it well. This article focuses on the split that matters most: among firms that already report well, some use that reporting to build operational capability, and others do not. On paper, the two look identical. Under stress, they diverge.

A false sense of security can delay hard operational decisions. When disclosure is mistaken for risk management, weaknesses remain untested until a shock exposes them.

Are You Reporting or Preparing?
Among companies with high-quality climate reporting, two positions emerge based on our work:

Surface strategists. These firms use reporting primarily for external reassurance: regulatory compliance, stakeholder communication, and reputation management. Disclosure is polished, but operational preparedness is weak. This is the most dangerous position because strong reporting creates false confidence while critical exposures remain unaddressed.
Leading adapters. Companies in this category use reporting as a strategic tool to strengthen operational resilience. Disclosure drives internal foresight, stress-tests strategy, and identifies gaps before disruptions occur.
The danger is that surface strategists and leading adapters are indistinguishable based on disclosure quality alone. Both publish sophisticated reports. Both signal commitment. The difference only emerges under stress, when a shock reveals whether reporting drove operational capability or simply documented stakeholder expectations. What separates prepared organizations from vulnerable ones is not whether they report, but whether reporting builds operational capability.

We find that five questions reveal the difference between reporting and preparing:

Are climate disclosures designed mainly to meet external expectations rather than drive internal decision making?
Can the CFO or COO name the top three climate risks without consulting the sustainability team?
Have climate scenarios ever changed a major investment, footprint, or supplier choice?
Does a senior risk executive, not a communications or compliance function, own climate risk with board access and budget authority?
Does reporting surface uncomfortable gaps or mainly document what stakeholders expect to see?

10/13/2026

The CEO’s singular impact on the success—or failure—of AI in organizations
September 30, 2026 | Article
https://buff.ly/6Mb1A5N
There are certain aspects of the AI opportunity that chief executives cannot hand off to others—raising the organization’s ambition, rearchitecting how it works, and resetting its culture.

AI adoption is everywhere. Token costs have become a board-level topic. Pilots are proliferating in companies, across every function and geography. Yet relatively few CEOs point to enterprise-level financial impact from AI: McKinsey research shows that 89 percent of organizations are reporting regular use of AI in at least one business function. Yet the proportion of AI high performers, or those who attribute at least 5 percent of EBIT to their use of AI and describe the technology’s impact as “significant,” has remained flat at about 6 percent of all respondents to McKinsey’s State of AI survey.1

There is still a notable distance between AI’s promise and the value companies are realizing from it. Technology isn’t the sole reason for this gap, however. There’s also a gap in leadership—rooted in business fundamentals such as strategy, organization, culture, and risk, but magnified by the rise of AI.

CEOs’ AI moment is shaped by a series of paradoxes: Move fast and commit boldly to AI despite the absence of benchmarks or best practices. Be decisive about where to place your bets but retain some optionality; AI models and tools will evolve, and any commitment will need to be revisited. Build proprietary advantage using AI tools that are available to everyone, but recognize that product and process differentiation will come from how quickly your organization learns, not the model or provider you use. Emphasize productivity enhancements through AI and use those efficiencies to help fund the rewiring journey, but remember to invest just as much in growth—efficiency alone is not a survival strategy. Embrace AI deeply, but don’t cede your organizational identity to it. The strongest companies will use AI to double down on what makes them distinctive now and what will set them apart in the future rather than reflexively pivoting to a generic “AI-first” playbook.

This is not just another technology cycle. It is a metamorphosis of the organization, with choices that can only be made by the CEO.

These imperatives are complicated and interrelated, presenting CEOs with a unique business challenge: AI is changing how companies approach strategy and planning, talent development, capital allocation, technology systems, corporate culture, and the value proposition to customers. No other technology trend of this leadership generation has so thoroughly affected all six of these domains at once, which means no single function can completely own this challenge. This is not just another technology cycle. It is a metamorphosis of the organization, with choices that can only be made by the CEO.

10/12/2026

How Leaders Counter Pessimism in Trying Times
by Michelle Gielan

From the Magazine (forthcoming November–December 2026)
Harriet Lee-Merrion
Summary. When teams face challenging times and are overwhelmed by negative news, failures, roadblocks, or uncertainty, the learned helplessness and pessimism they feel can erode engagement, energy, and performance. Leaders cannot remedy the situation with forced positivity; instead, they need to encourage resilient optimism—the ability to see challenges clearly while still believing that action matters—in three ways. First, they should model constructive behavior by directing attention toward purpose and progress, prioritizing visibly rather than spreading urgency, and treating restoration as part of sustainable performance. Second, they should help employees reframe stress as useful information, using practices such as signal checks and “yes, and” language to acknowledge difficulty while encouraging people to problem-solve. Finally, they should actively create and amplify positive moments—through praise, small acts of support, and renewed connection—so that their employees begin to see evidence that their efforts still make a difference.

Many leaders are managing this kind of pessimism right now, and research explains why. In a study I ran with Arianna Huffington on how negative information affects the brain, we gave people three minutes of negative news in the morning, then measured their mood six to eight hours later at the end of an ordinary workday. Compared with the participants in the control group, who saw three minutes of neutral content, the people in the negative-news group were 27% more likely to describe their whole day as a bad one. Days upon days of such exposure—whether world news, industry warnings, or team and personal setbacks—can wear down well-being and performance until work starts to feel pointless. Against that backdrop, it is not surprising that employee engagement is at a 10-year low and that more than half of U.S. workers report burnout.

Feeling pessimistic, apathetic, or stressed out is not a character flaw. Our bodies are wired that way. The brain has a bias toward negativity, weighting threats far more heavily than reassurances, so a few alarming inputs can color people’s thoughts for hours. Feed that bias an always-on stream of problems mostly outside our control, and it hardens into something more corrosive. Martin Seligman, the founder of the field of positive psychology, called a version of this pattern learned helplessness: the mental state people enter when they conclude their actions can no longer change the outcome. I studied at the University of Pennsylvania with Seligman, and I often see the effects of learned helplessness in employees: Keep your head down, don’t bother, nothing changes anyway.

That attitude is both personally and organizationally destructive. Having tested more than 25,000 professionals in Fortune 500 companies, hospitals, and school districts over the past decade, we have consistently found that pessimists are not only less engaged but also less successful. People who scored the highest in work optimism—strongly agreeing with statements about their workplace such as “I generally expect things to go my way,” “I feel optimistic about the future,” “I anticipate more good than bad,” and “I believe my behavior matters”—were, by contrast, three times more likely to be highly engaged, 40% more likely to be promoted within 12 months, and five times less likely to burn out. Other studies have found that people with a positive mindset are 31% more productive and that optimists outsell their pessimistic peers by 37%.

Here’s the catch most leaders miss: You can’t cure pessimism with a motivational speech or a good-vibes-only demeanor. Research shows that when people feel they must fake positivity, it leads to higher burnout. Instead, you need to build a culture of what I call resilient optimism: the ability to see challenges clearly while believing that actions can still influence outcomes.

By studying effective managers, I’ve found that you accomplish this through a set of simple behaviors: modeling optimism, reframing stress, and highlighting progress.

10/12/2026

The speed problem: How frontier AI exposes weakness in enterprise cybersecurity
September 11, 2026
https://buff.ly/1jvxb6g
Attackers now move at machine speed, but organizations make decisions at committee speed. To close the gap, businesses need a different operating model and committed executive leadership.

There has been an important shift in enterprise cybersecurity, and it is not the arrival of more sophisticated malware. It is the collapse of time.

For decades, organizations managed cyber risk on the assumption that they had time to detect vulnerabilities, assess their severity, navigate approval processes, schedule patch windows, and deploy fixes. That assumption is now obsolete. Industry tracking data suggest that the average time between the disclosure of a vulnerability and its active exploitation is just a matter of hours

AI models, including Anthropic’s Mythos/Fable, OpenAI’s GPT-Cyber, and Google’s Gemini, represent a genuine step change. Rather than simply speeding up attack workflows, they unlock discovery and exploitation, making them accessible to a far larger group of potential attackers. McKinsey analysis suggests that critical novel vulnerabilities without available patches now account for most active exposures.

The question for organizations is not whether a vulnerability will be exploited before it can be patched, but how many vulnerabilities will be exploited. Frontier AI is a concern for chief security officers (CSOs) and chief information officers (CIOs) because it enables more effective attacks and does so faster than enterprise decision-making (Exhibit 1). From that perspective, it presents organizations with an operating-model problem instead of a technology problem.

Defenders must change how they respond across the AI-enabled cyber kill chain.

Organizational latency: The hidden challenge
When asked what is preventing them from responding faster to critical system vulnerabilities, most security leaders seldom say it’s the technology itself. Many organizations already have robust detection tools, patch management platforms, and incident response playbooks. Rapid responses can be achieved with highly standardized environments, zero-trust architectures, and deployment-as-code capabilities. The greater challenge lies in the decision-making processes, governance, and operational coordination needed to translate technical capabilities into action at speed. Consider what often happens when a critical vulnerability is discovered:

IT security identifies the vulnerability and assesses its severity and the systems affected. This can take a day or more, depending on the visibility of assets across legacy systems, cloud platforms, software-as-a-service (SaaS) applications, and operational technology environments, which are rarely fully inventoried.
The security team escalates the event to IT leadership, which must assess the butraitsiness impact before authorizing patching. IT leadership then must speak with application owners who are managing release schedules and change freezes.
The patching of both vendor/off-the-shelf and in-house software must be tested. Organizations that still manage substantial custom or legacy code—which includes most large enterprises—frequently face weeks of validation work before a fix can be certified for production deployment.
Scheduling the patch window and understanding the release window requires IT leaders to align with people in the business. If they do this, they facilitate business as usual. Manufacturing does not have to stop production lines for patches during peak periods, hospitals do not have to take clinical systems offline during patient care hours, and financial institutions can avoid changes in peak transaction windows.
Deployment requires sign-off from a change management leader. In many organizations, this requires a change advisory board that meets weekly.
After all this, vendor-managed and third-party systems may operate on entirely independent patch timelines that no internal team controls.
This is not dysfunction but rather how large organizations are designed to operate. The processes exist to protect up time, manage regulatory compliance, preserve service quality, and avoid the operational disruption that poorly tested patches can cause. However, frontier AI changes the game. Vulnerabilities that once could remain exposed for weeks must now be addressed within hours to stop attackers from causing damage. Organizational architecture has become a direct security liability.