Perspectives on Leading Through Change: (Re)thinking Risk Without Borders
An interview with Anthony Ferrante, Global Head of Cybersecurity and Senior Managing Director, FTI Consulting
Anthony Ferrante is a nationally recognized leader in cybersecurity, crisis management and emerging risk. A former senior official at the Federal Bureau of Investigation, he led cyber threat response efforts involving national security, cybercrime and complex digital threats. Today he advises boards, executives and global organizations on cyber incidents, mobile and endpoint compromise, insider threats and executive protection. He spoke during the [Directors Dialogue](faculty-research/centers-institutes/gupta-governance-institute/directors-dialogue session) “Perspectives on Leading Through Change: Rethinking Risk Without Borders” about the rise of mobile-driven cyber risk and why boards need to rethink cybersecurity oversight in a distributed, always-connected world.
You’ve said the traditional cybersecurity perimeter is effectively gone. What does that mean?
The enterprise is no longer a fixed environment behind a firewall. What used to sit securely inside a server room now travels everywhere with people. Data now exists on mobile devices, in cloud systems and across networks that organizations do not fully control. Every device is now a potential entry point for a cybersecurity attack.
The enterprise is no longer a place; it’s a network of people and devices.
How much of this shift is being driven by mobile devices?
A tremendous amount. We started seeing mobile malware incidents several years ago, but over the last twelve months the volume has increased dramatically. We are now seeing these threats affect board members, executives, journalists and organizations operating globally.
Why are mobile devices so difficult to govern?
Because they blend personal and professional life. They travel constantly. They connect everywhere. They are used in unsecured environments, handed to family members, taken into hostile countries, and connected to sensitive corporate systems.
Mobile devices travel everywhere and connect directly into corporate environments. That changes the entire risk model.
Are companies overconfident about their mobile security?
Yes. Almost every organization I work with initially believes they have this problem handled. After a few hours of assessment, they realize they are effectively blind.
Organizations often believe they have visibility into mobile risk because they use mobile device management tools. But managing a device is not the same thing as understanding whether it has been compromised.
You talked about “digital exhaust.” What does that mean?
Every device continuously emits information about you including location signals, browsing behavior, app usage, public postings and metadata. All of it creates a digital trail. Sophisticated attackers leverage this publicly available information to conduct reconnaissance long before they ever attempt an intrusion.
We can often show executives personal details about themselves and their families entirely from open-source information, and they are shocked to realize how much information is publicly accessible.
What is the biggest misconception boards have about cybersecurity today?
Many leaders still think cybersecurity is primarily about protecting infrastructure. In reality, organizational risk travels with individuals through devices, behaviors and digital footprints. That requires a very different governance mindset.
How has cyber risk shifted from system risk to human risk?
Cyber attacks that historically targeted infrastructure and systems are increasingly targeting people and behavior. Mobile phones contain everything attackers want including communications, credentials, network access, location data, behavioral patterns and identity information.
Every interaction with a phone introduces potential exposure that can be exploited quietly through infected links, compromised websites, malicious applications or operating system vulnerabilities.
Human behavior is deeply intertwined with organizational risk and as critical as technology in reducing cyber exposure.
What does a real-world mobile threat look like?
Most people assume a cyber attack would be obvious. The most sophisticated mobile compromises are usually invisible. Most people will never notice it happening until significant damage has already occurred.
FTI Consulting worked with a multinational company concerned about potential insider threats and compromised executive communications. Our team analyzed more than 200 corporate and personal mobile devices across multiple countries using advanced forensic techniques beyond standard mobile management tools.
We uncovered more than 15 devices infected with nation-state malware. None of the affected individuals knew they had been compromised, and the company’s existing controls had not detected the threat.
Are boards sufficiently focused on mobile risk?
Boards spend a great deal of time discussing AI risk, ransomware and major breaches, but mobile malware and endpoint exposure remain significantly under-governed.
Mobile threats are designed to operate quietly while collecting communications, credentials, behavioral information, location data, and potentially creating pathways into broader enterprise systems. That’s the reality boards need to understand.
What are boards missing in their cyber reporting?
Traditional dashboards often create a false sense of comfort because they measure what organizations can see, not necessarily where exposure truly exists.
Boards should ask management very directly: Can you actually see what is happening on these devices? Can you demonstrate how compromise would be detected and contained?
When management tells you everything is fine, say ‘Show me.’
What should directors be doing differently?
First, recognize that this threat already exists. This is not theoretical or future risk. Second, challenge management more deeply. Ask how devices connect into corporate systems. Ask what happens when a device is lost or compromised. Ask whether executives are mixing personal and corporate communications. Most importantly, directors should understand that this is fundamentally a human problem as much as a technology problem.
Can cyber risk ever be eliminated?
Anyone who tells you they can eliminate cyber risk is lying. It can only be mitigated. With AI accelerating attack capabilities, organizations must become faster at identifying and responding to threats rather than assuming they can prevent all of them.
The goal is not perfect prevention. It is visibility, rapid identification, response capability and operational resilience.
How should organizations balance security with convenience and innovation?
You cannot shut down mobility. Mobile technology enables speed, flexibility, productivity and global business operations. The answer is not eliminating usage. The answer is understanding exposure and managing it intelligently
Organizations need realistic awareness of risk rather than false confidence.
Additional Resources
