Staged spear-phishing tests can fool even CEOs and board directors. With AI, attackers can assemble a detailed profile of you within hours. Your personal cyber hygiene is now a governance issue.
When the new CEO of the world's largest sovereign wealth fund started his job in 2020, the IT security team gave him a tough welcome present. They exposed him to a staged spear-phishing attempt, using his hometown newspaper and summer cabin as bait. And he walked straight into the spear [1]. The CEO was Nicolai Tangen and the fund was the Norwegian sovereign wealth fund (NBIM), at that time worth just under EUR 1 trillion.
At this time, Tangen stated that cybersecurity was his top concern, more important than the fund's market exposure. In November 2022, ChatGPT was launched. Since then, Tangen's public focus has shifted from cybersecurity towards AI adoption. But let's not be naive. The reason Tangen and NBIM can afford to go all in on AI is that strong cybersecurity and governance are already part of NBIM culture.
According to the recent Threat Landscape 2026 report by ENISA, the European Union Agency for Cybersecurity, attacks of all types are increasing in scale and sophistication. The number of denial-of-service (DDoS) attacks more than doubled from 2024 to 2025 whilst the number of phishing domains have increased by 38%. For more details, see link to the report below [2].
Why executives are attractive targets for cyberattacks
But why don't we just use AI to detect and prevent cyberthreats, you ask? We do. The thing is, attackers are usually quite clever, and they also use AI. This means that attackers and defenders are in a continuous neck-and-neck race. A key challenge, though, is that on the "good side", the clever information security professionals you hired to protect your company also have to deal with naive and thoughtless users. Meaning you (and most other employees). Even the best security teams become lame ducks when the owner of the house leaves the front door unlocked with the vault code pinned to the wall in the hallway.
With AI readily available to both the good and the bad actors, lots of information about you as owner, board director, executive, and decision-maker is quite easily available somewhere on the big internet. What's more, there is probably also heaps of information about your spouse, kids, running track, friends, holiday locations, drug habits, sexual preferences, political inclinations, and past unpalatable statements on social media. In addition, you are probably sloppy with your electronic devices, enabling easy access to confidential information on all your devices. With AI, all of this information can be collected, assembled and utilised with a spear-phisher's precision within minutes or hours.
Board directors and executives often ask me why threat actors would be interested in them or the companies they represent. They are interested in you as a board director or executive because you are the top dog with the access and authority to share confidential information, approve financial transactions, and give orders to execute operations. They are interested in your company for one of four reasons:
They want your company's IP.
They want financial gain, either through ransom attacks, fraud, or theft.
They want to create chaos, either for your company or for the society in general.
They want access to another company in your value chain, and your company is only the entry point.
You need to wake up. Your personal cyber hygiene matters.
Ten basic cyber hygiene habits
Slow down and verify before acting on "urgent" requests by email, SMS, chat, etc
Use passkeys instead of passwords if possible, combined with multi-factor authentication.
Use a password manager to help you "remember" credentials. Don't use passwords that are easy to remember, and don't use the same password in several places.
Update your devices immediately whenever new security updates are available.
Don't scan QR-codes from sources you don't trust.
Verify unusual requests through a second and third channel. Agree on code phrases with family members and key employees for urgent actions.
Don't connect your own or your family's devices to open networks - i.e. unsecured public Wi-Fi networks. This includes airports, hotels, cafes etc.
Don't share more information about yourself and your family online than strictly required, and minimise who can see what.
Don't let AI agents act or approve decisions/actions on your behalf. [Read more about this topic here: AI agents - a potential governance nightmare]
Stay calm. Being tricked into stressing will reduce your critical assessment skills.
The basics of information security are simple. Anyone can do them. It's boring, I know. But it's more boring to get your life, finances, or company hijacked and potentially bankrupted.
Cybersecurity governance: What this means for your board
Hygiene is personal, but the consequences may reach far beyond the individual and severely damage the enterprise, financially, operationally and reputation-wise. For the board and C-suite, this means:
Treat executive and board director cyber hygiene as part of enterprise governance. Add expectations for personal security practices to onboarding and periodic risk assessments. With NIS2, European regulators already treat cybersecurity as a board and executive responsibility, and compliance with your own rules should be a given.
Make phishing tests mandatory, and celebrate reported failures. Nicolai Tangen went public with his failed phishing test. His candid openness was crucial for building a strong security culture in NBIM. Make it safe to fail, that way more failures will be reported fast enough to prevent major damage. A security culture where people are afraid to report their mistakes is itself a security risk.
Prepare for the day when you are the one who is compromised. Who does what when, through which channels? When shit hits the fan, you need to know how to turn the fan off as fast as possible and get the cleaning crew working.
If you would like to discuss the role of the board or C-suite in fighting cyberthreats, I’ll be happy to meet in person or online to explore angles of attack.
About the author
Elin Hauge is a keynote speaker, AI strategist, and trusted advisor to business leaders and boards. She specialises in helping organisations make sense of artificial intelligence beyond the hype, connecting technology to strategy, governance, and real-world value. With a multidisciplinary background in physics, mathematics, business, and law, Elin brings both analytical rigour and practical perspective. Her talks and advisory work empower leaders to ask better questions, make wiser decisions, and navigate AI with confidence.
➡ Read more about Elin
Frequently Asked Questions:
-
CEOs and board directors have access to confidential information, financial decision-making authority and organisational influence. This makes them attractive targets for phishing, fraud, espionage and other cyberattacks.
-
Executives should use passkeys or strong authentication, keep devices updated, verify unusual requests, limit personal information shared online and report suspected phishing attempts immediately.
-
Boards should oversee cybersecurity risks, set expectations for executive security practices, encourage transparent incident reporting and ensure that the organisation is prepared to respond when someone is compromised.