Keynote Speaker Brian Scott Shares Three Cornerstones of Defense Against Cybercrime During 2026 FGIA Annual Conference

Brian Scott, President and Chief Information Security Officer(Clear Tone Consulting), presented “The Cybercrime Machine: Breaking Down Complexity, Building Simple Defenses” and addressed the ever growing field of artificial intelligence when it comes to sophisticated techniques on the part of hackers.

“Open your eyes a little bit,” said Scott. “Understanding what’s going on will help you defend against a growing surge in cybersecurity incidents.”

Scott said that, while AI can be a helpful tool, when it comes to cybersecurity crime, it’s hurting us.

“If it were measured as a country, cybercrime would be the world’s third-largest economy after the U.S. and China,” said Scott. “The global cost of cyberattacks is projected to reach $10.5 trillion in 2026, with ransomware, phishing and data breaches. AI is driving the professionalization of cybercrime, leading to more realistic and dangerous cyberattacks. Cybercrime has industrialized, and there is an entire supply chain.”

Scott pointed to the old forms of “phishing” emails, which were easy to identify by their poor grammar and generic nature. However, “those days are gone,” he said. “AI phishing is personalized and context aware. Data can be pulled from LinkedIn, websites or social media. They know who your boss is and can impersonate them. Automated generation is possible, and at scale.”

When it comes to protecting companies against this, there are three cornerstones of a defense for all organizations, according to Scott: email, identity and infrastructure protections.

Email Protections

Because human error is the biggest cause of breaches, training staff on phishing simulations is critical, said Scott. “Phishing remains the most common initial attack vector, but staff awareness can dramatically lower click through rates,” he explained. It is important to foster a “report, don’t punish” culture when it comes to testing employees. Employing a robust SPAM filter can also help prevent malicious emails from reaching employees and reduce companies’ exposure to malware and credential theft.

Identity Protections

“Use multi-factor authentication [MFA] everywhere,” said Scott, when it comes to protecting individual identities. “There are good ways and bad ways to do it. I know it can be confusing, but it can be done in a centralized way that helps.” Passwords are easily stolen, guessed or reused, Scott said, but MFA can block 99 percent of automated attacks. It is required by most cyber insurance and compliance frameworks. Another tip Scott offered is enforcing the use of a password management system to eliminate risky practices like password spreadsheets or sticky notes. “Provide your staff training on proper use of the tool,” advised Scott.

Infrastructure Protections

When it comes to protecting a company’s infrastructure, Scott recommended using Next-generation Antivirus (NGAV) as endpoint detection and response (EDR) or managed detection and response (MDR) services. “Traditional antivirus software cannot keep up with modern threats,” Scott said. “EDR enables real-time endpoint visibility while MDR extends 24/7 monitoring and expertise.” Scott recommended deploying NGAV on all endpoints.

For more information about FGIA and its activities, visit FGIAonline.org/Events.