Latest / C-Suite Perspectives / Control Risk's Lessons on Keeping Your Executives Safe

Transcript

Control Risk's Lessons on Keeping Your Executives Safe · C-Suite Perspectives

0:00
Welcome to C-Suite Perspectives, a signature series by The Conference Board.
0:04
I'm Steve Odland from The Conference Board and the host of this podcast
0:07
series, and in today's conversation, we're going to talk about corporate risk.
0:12
Lots of things have happened over the past year or two to fundamentally change
0:16
how organizations view risk, in general, and executive risk, in particular.
0:21
We're going to talk about all these evolving trends and outline what
0:25
companies can do to strengthen resilience, protect their executives,
0:29
and safeguard their organizations.
0:32
Joining me today is Bill Udell, the CEO of Control Risks Americas.
0:37
Bill, welcome to the show.
0:39
Thanks, Steve.
0:39
Thanks for having me on.
0:41
Yeah.
0:41
So Bill, let's start with a little bit about what Control Risks does
0:46
and, in particular, what you do for all of your corporate clients.
0:52
Sure, yeah.
0:53
Control Risks is a 50-year-old operational risk consultancy.
0:57
So we got our start in 1975 out of the kidnap-for-ransom response business.
1:03
And we still do that, but we've spread out into a wide variety
1:07
of crisis management, security, investigative, business intelligence,
1:12
geopolitical risk issues, as well.
1:14
And we operate around the world, helping companies become more secure, more
1:19
compliant, more resilient, helping them respond to crises and seize opportunities.
1:24
And for the purposes of this conversation around executive security, we bring
1:29
physical security, cybersecurity, threat monitoring, and crisis response
1:35
together to help advise organizations on how to deal with these challenges
1:39
and then build programs around them.
1:41
Yeah, and you've been doing this for a long time.
1:43
You're an expert at it.
1:44
You have experience with the CIA and other entities, so you're
1:48
really an expert broadly, not only in the corporate world, but really
1:53
geopolitically and globally, as well.
1:56
Yeah, and we have a wide variety of experts working for us.
1:59
So, for example, behavioral analysis experts from the
2:03
behavioral analysis unit at the FBI.
2:05
Geopolitical experts from intelligence agencies around
2:09
the world and from governments.
2:10
And then academics and a wide variety of other experts, as well.
2:14
So trying to bring those together to create solutions for clients
2:17
that address their real needs.
2:19
So, over the past couple of years, you can't pick up a newspaper or tap
2:24
in online without seeing examples of corporate security issues.
2:30
Maybe talk through what are some of the hottest issues for companies today?
2:35
Yeah, certainly the hottest issue and one of the most present issues for companies
2:40
in the security space—I mean, we can talk separately about geopolitics, and I
2:44
listened to your podcast on top risks for 2026 and focused on trade and tariffs.
2:50
And we're obviously talking to clients a lot about those issues and the
2:54
geopolitical implications of moving away from our old rules and to new rules and
2:59
crossing red lines that we thought might not have been crossed, and what that
3:03
means for companies caught in the middle.
3:05
But if I drill down into security, specifically, the biggest topic
3:09
over the last year, particularly in the United States, has been
3:13
around executive security.
3:15
And very much, for a lot of executives, it's really the first time that they're
3:20
thinking about this because of, the big reason for that being the shooting of the
3:25
United Healthcare CEO, Brian Thompson, on the streets of New York just over
3:29
a year ago, back in December of 2024.
3:32
And the reason that this is such a big watershed moment in the security space for
3:37
our clients is, the shooting was obviously a tragedy and a jolt in and of itself.
3:43
But for a lot of CEOs and executives, they realized, hey, this is someone
3:46
that is outside of the public eye, would've previously been low risk.
3:51
And then the other thing is what happened afterwards, the resulting lionization of
3:56
the shooter, the vitriol that followed, the threats that centered first on
4:01
insurance and healthcare and financial services, but then spreading out from
4:06
there into what we've sort of been referring to as a series of threat waves.
4:11
It's obviously not the latest incident.
4:13
There have been many more since then.
4:14
There's been a string of obviously targeted violence over the last year.
4:18
So the NFL building shooting, the Charlie Kirk assassination,
4:22
Minnesota lawmakers, and those are just the ones that make the news.
4:25
What's really been consuming our clients and executive teams—and we'll talk about
4:31
the sort of convergence of physical and digital in a little bit—but it's
4:35
the enormous number of threats, both physical and online, that the Fortune
4:41
500 executives have been receiving, and the huge spike in those over the last
4:45
year that really haven't been reported.
4:48
That's really an important point, Bill, because when these things happen,
4:51
you don't want to advertise them.
4:53
So companies are very quiet behind the scenes, and so the stuff that
4:57
you see in the paper is just the tip of the iceberg, isn't it?
5:01
Yeah.
5:01
That's exactly right.
5:02
And we've seen, and we can talk a little bit about what we would recommend our
5:07
clients do, but we have seen a shift in the way that security teams and executive
5:11
teams have been handling this because not just of the volume of the threats,
5:16
but also the wider reputational impacts, the vitriol that goes along with it.
5:21
And really driven by this mix of political polarization, personal
5:26
grievance, online radicalization, mental health issues, leads to the
5:31
sort of targeted violence and threats.
5:34
And those didn't just start in December of last year.
5:37
That was a trend that we saw coming, really, since the pandemic.
5:40
You could see it in a number of metrics, whether it's the
5:43
increasing numbers of open FBI investigations or similar indicators.
5:49
And they can start with very benign things.
5:51
A regulatory dispute.
5:53
In the case of the BlackRock executive being killed in the NFL shooting, there
5:57
was a huge amount of online threats that were then aimed at Blackstone because of
6:03
the naming confusion between Blackstone and BlackRock, and people getting
6:07
their conspiracy theories mixed up.
6:09
So it's really difficult for companies to predict when these swells of threats are
6:13
going to occur and how they might impact, both physically and reputationally.
6:17
Yeah.
6:17
And it used to be that when you traveled to Third World countries,
6:21
that you were trying to protect against a kidnap for hire or kidnap
6:25
for ransom kinds of situations.
6:28
But that was always in quote-unquote dangerous areas.
6:31
Now, as you said, we're talking about the streets of New York, which, that's home.
6:36
It's not because this is a really bad individual or this person
6:41
has done something, it's a little bit more about society and making
6:46
demonstrations against people.
6:49
So it's not necessarily entirely random, although some of it is, but
6:52
it's feeling a little more random.
6:54
And then the huge outpouring of support for blatant murder is
7:00
really frightening in our society.
7:03
Yeah.
7:04
And that, if I sort of rewind back to December of 2024, that was something
7:09
that caught executives really off-guard, was that kind of linkage between the
7:13
actual violence on the street and the upwelling of anger at certain sectors.
7:20
And how that can create this, what we call a threat wave, where you have an
7:25
individual incident or something in the news that then causes a cascade of
7:29
threats against maybe that company or that sector, but then spills over into a
7:34
lot of other sectors and a lot of other people that had nothing to do with that.
7:37
And we are seeing that time and time again.
7:40
So it's critical that companies do the deep and dark web monitoring, do the
7:46
open-source monitoring, reputational monitoring, and understand the profile
7:51
of their executives to be able to predict when they might get caught in these threat
7:55
waves, as difficult as that is to predict.
7:57
So this has become less about this sort of niche security issue, which is a
8:04
small business, but to really a corporate governance issue because if you're
8:07
thinking about this from a board of directors perspective, or from certainly
8:12
senior management, if there's damage to you key operators in the company, it can
8:17
significantly damage the operations of a company, shareholder value creation.
8:21
All of that is tied to individuals.
8:24
So it goes beyond that to your ERM processes, enterprise risk management
8:28
processes, and core governance issues.
8:31
Yeah, that's right.
8:32
I mean, if you just rewind just a couple of years ago, for most companies
8:37
outside of those that were founder-led, where the enterprise value was really
8:41
tightly associated with one individual, I think executive risk and executive
8:46
security was seen as a, as you say, that sort of niche security issue.
8:51
And again, and back to the UHG incident, that was a watershed moment when you're
8:56
really realizing the potential strategic impact that a single issue can have.
9:01
So after that incident, UHG lost a hundred billion in market value.
9:06
And like you said, the loss of a key executive, it's been
9:09
on the ERM register for years.
9:11
We've talked to clients about it.
9:13
We've helped them build ERM programs that included that.
9:16
But it's always gotten honestly, a little bit of lip service until a year ago.
9:21
We are very much in the last year in a new area where it becomes really strategic
9:27
risks that executive teams and that boards are paying much more attention to.
9:33
And it isn't just about the violence or the threat or the tragedy itself
9:38
or the loss of the executive itself.
9:40
It's about that wave of reputational damage and public
9:43
hostility that often follows.
9:45
And we've seen that several times in the last year.
9:48
Well, it then suggests that there needs to be a reframing
9:51
of these protective services.
9:55
Right Because right now, corporate security or a driver for key executives or
10:01
private air travel, that's all viewed as a perk for an executive, and is imputed in
10:07
the compensation, reported in the proxy.
10:09
And it's become a flashpoint of, gosh, we got to cut this cause
10:12
this guy's, this person's overpaid.
10:15
But in fact, we have to reframe this because private
10:19
air travel, it's not a perk.
10:21
It can be, and it can be abused.
10:23
There are bad situations that have happened historically.
10:25
But for the most part, it's about security and safety.
10:28
And so, it requires that boards and proxy advisors and all the constituents
10:34
think about this and frame it differently.
10:37
I mean, very much.
10:38
And as you say, traditionally, executive security, in air quotes,
10:43
meant executive protection, meant physical executive protection.
10:46
It meant just security while traveling abroad or private travel or
10:51
certain aspects of crisis response.
10:53
And just the threat has become so much more, and the impact has become
10:56
so much more multidimensional.
10:58
So spanning physical, digital, reputational, legal domains.
11:04
I mean, a simple thing of a leaked address or a deepfake video can
11:07
just dominate headlines overnight and erode shareholder trust.
11:11
So both on the preparedness side and what you're actually doing and what
11:15
you're defining as executive security, and then, but on the impact side, in
11:21
terms of what the implications are of getting it wrong, it's radically changed.
11:25
And those security measures that you mentioned, like private air travel or
11:29
executive protection, they have to be tailored, they have to be fit to the
11:33
actual risks that the executive faces, and it can be done very efficiently.
11:37
But ultimately, the money that companies are spending on that is a drop in
11:40
the bucket next to the implications for getting it wrong, when you look
11:44
at shareholder value and reputation.
11:47
I suspect if, and you talk to boards all the time, boards of directors
11:51
and management teams, I suspect that most people feel like they've done
11:55
a good job and that they're covered.
11:57
But there's always some new crisis, right?
11:59
I mean, just walking down the street is this latest example.
12:02
Where do you most often see the gaps in risk preparedness?
12:07
After December 2024, we had companies coming to us in all sorts of states of
12:13
preparedness and thinking that they were prepared or knowing that they weren't
12:17
prepared or, in some cases, having done the right things as they saw this risk
12:21
coming, and they truly were prepared.
12:23
But I think generally, I mean, if I could make a broad statement about
12:27
preparedness, I think generally there's an overestimation of existing
12:31
preparedness and an underestimation of the complexity of the problem and the
12:37
multidimensionality of the problem.
12:39
I think companies often will kind of fall into the trap of trying to take a
12:44
kind of a one-size-fits-all approach to security risk management, generally, and
12:49
security for executives, in particular.
12:52
But given that complexity and the drivers, the complexity of the drivers of the
12:55
threat, too, that's really difficult.
12:57
So the most basic level, and I mentioned this earlier, but I think
13:01
we still see a lot of companies that do not understand, basically,
13:05
the risks that truly impact them.
13:07
They understand threats generally in the world, but they don't understand
13:10
the risks that truly impact them.
13:12
So they may be over-egging or overpreparing in some areas
13:16
and underpreparing in others.
13:18
So those risks should be really categorized by likelihood and
13:21
impact of them actually occurring.
13:23
And that has to be dynamic, it has to be consistently assessed, and has to
13:27
inform then everything that comes after.
13:31
Then once those risks have been identified, we see too many companies
13:34
that don't monitor for changes.
13:36
So the world is moving really fast, and monitoring for changes and spikes
13:41
and getting a real-time sense of how those risks have changed is critical.
13:46
And then last thing I think is if we assume that those risks have been
13:50
identified and are being monitored.
13:52
Identifying a threat and risk is obviously not the same as being ready to respond.
13:57
So the real difference lies in how prepared the organization is, and
14:01
that's about holistic governance.
14:03
It's about agreed risk registers and audits and specific plans.
14:07
We see, too often, risk management in the security space being really siloed,
14:13
and it's just about the security team.
14:15
And increasingly for executives, that now, like I said, needs to span cyber, it
14:19
needs to span physical, it needs to bring in legal and ops and HR. It needs to be
14:25
a very much a whole-organization effort.
14:28
So I would say just in terms of where we see gaps, just at the very basic
14:32
level, it's about understanding the real risks that impact you as a business,
14:37
and then making sure that the response and the preparedness isn't siloed in
14:40
one kind of niche part of the company.
14:44
We're talking about corporate and physical security.
14:46
We're going to take a short break and be right back.
14:50
Welcome back to C-Suite Perspectives.
14:52
I'm your host, Steve Odland, from The Conference Board.
14:54
And I'm joined today by Bill Udell, CEO of Control Risks for the Americas.
15:00
So, Bill, before the break, we talked a lot about all the
15:03
emerging physical security risks and some of the corporate risks.
15:08
The Conference Board just completed its 27th annual C-Suite outlook survey,
15:13
and interestingly, with over 1,700 executives polled in the survey and
15:20
over 770 CEOs polled, the number one geopolitical risk was cybersecurity.
15:26
And you don't think of cybersecurity as being a geopolitical risk,
15:31
but you're seeing that, as well.
15:33
Yeah, we absolutely are.
15:35
And we've seen this, honestly, for many years.
15:37
If we rewind 10 years, we saw state-sponsored cyberattacks that
15:43
used highly advanced tools that then allowed for the escape of other
15:48
highly advanced tools, and were very much driven by geopolitics.
15:53
And the geopolitical great-power rivalry between Russia and the United
15:58
States, or China and the United States, ending up in the spilling over of
16:02
previously very well-protected attack tools in the domain of cybercriminals.
16:07
So I think for a long time, there's been an intersection of
16:10
geopolitics, great-power rivalry, and cybersecurity and criminality.
16:15
I mean, that has been a swirl for a while, but certainly what we're
16:19
seeing now is this combination of, as I mentioned before, this political
16:24
polarization in the United States, the issues of grievance of mental health.
16:30
Then combining, and being accelerated by, increasingly over the last year
16:35
in particular, the return of real great-power rivalry and companies
16:40
being stuck in the middle of both of those forces—so both international
16:44
geopolitics and then stressors at home in the United States, and that then
16:49
having a direct impact on cybersecurity posture, on physical security posture.
16:54
And what the definition of digital security and physical security are, if
17:00
we look at what we used to call cyber, those lines are very much being blurred.
17:05
So something that starts as a cyberattack and is an information exfiltration
17:11
or ability to access proprietary and privilege information internally,
17:17
if you're targeting an executive, can very easily spill over into
17:20
the physical world, and vice versa.
17:22
Physical penetrations can help facilitate cyberattacks.
17:27
So that convergence is as strong as it's ever been.
17:31
And that line between those two things is quite blurred.
17:34
Yeah.
17:34
And the FBI and the CIA have issued a lot of reports on this.
17:38
Privately, they're sharing some of that information and the
17:41
data with companies, as well.
17:44
But the stuff that happens online on social media and so forth is
17:48
increasingly being driven by state actors.
17:51
You've got China trying to challenge the United States economically, primarily,
17:55
but not solely, also militarily, but Russia more from a military
18:00
standpoint, and Iran and others.
18:02
But most of the negative and provocative kinds of social media posts that
18:08
are stirring this up are coming from bots that are foreign-sourced.
18:12
And their intent is to undermine civil society, stir up the masses.
18:16
A lot of the protests that are seen around the country are funded by
18:21
these groups and outside sources.
18:24
What you're saying, all of this stirs the pot, and it creates a
18:29
tinder box for these kinds of issues.
18:31
And then you have, as you say, you overlay the mental health issues,
18:36
which also came up in our survey as one of the key things, and boom, you
18:40
come up with some really wild stuff.
18:41
So it's not just a one-off, it needs to be thought of more systematically.
18:46
And it really needs to be thought of in the, I mean, you're
18:48
exactly right, the wider context.
18:49
So there's the geopolitical angle, the great-power rivalry, the interference
18:54
and covert action campaigns that might be done by state actors to
18:58
influence our information environment.
19:01
That then combines with decades of decreasing trust in institutions in the
19:05
United States that had pre-existed.
19:08
And business in some ways, this was something that we saw coming out of
19:11
the pandemic, business was one of the most trusted institutions in the US.
19:16
And business leaders being increasingly asked to take stands on social
19:20
issues, and then, as a result, being caught in the middle of
19:24
these various forces when they did.
19:27
And then you sort of fast forward to the present day, and you combine all the
19:30
forces that you have talked about with the powerful emergence of AI and the
19:35
difficulty to trust your eyes when it comes to deepfaked videos and information.
19:41
So that then puts an additional pressure on business that is, again, caught in
19:44
the middle of trying to ensure that the information that they are putting out
19:49
into the world, and that is tied to their executives is even the real information.
19:53
So, if you combine all of that into this executive security challenge: the
19:59
fidelity of information, the reputational management, the trying to navigate
20:04
the geopolitical forces aligned with it, that makes cyber and physical
20:09
security a big, big, big tent issue.
20:12
And that's why we see it going from that security niche into what needs
20:18
to be addressed at the executive and board level, because it all
20:21
fits within that overall rubric.
20:24
Yeah.
20:25
And in our survey, as I mentioned, the mental health issues came to fore,
20:30
and that really was the first time.
20:32
We've always talked about well-being, and CEOs have been focused on the
20:37
well-being of their employees and their work environment, but it's
20:41
really the mental health piece of that.
20:43
And again, historically, it's been about, well, gee, the CEOs and then and senior
20:48
management need to do something to reduce the stress in the organization.
20:53
In other words, mental health or stress issues created by that environment.
20:58
That's not the case as much any longer.
21:01
I mean, there's still a little bit of that, but mostly, it's mental health
21:04
issues coming into the work environment.
21:07
And so when you've got that situation, any little grievance at all, stoked
21:12
by social media and all this other stuff, becomes a potential threat
21:17
to corporate and physical security.
21:19
So how should organizations monitor that and prepare for that.
21:25
Yeah, I would say one thing is that it is still, I mean, we are still
21:28
looking at a lot of insider threats.
21:31
So to where you started off the question looking at, working with
21:34
HR to identify mental health and grievance issues from the inside,
21:38
that is still very much a thing.
21:39
And these two, the external and the internal, very much need to be married
21:43
up into one risk management program.
21:45
But you're right, the much higher volume of potential threats
21:49
are coming from the outside.
21:51
And the ability of those to become viral and spin out of control is
21:55
very much accelerated by our media environment, by social media, by
22:00
the sort of echo chambers, by the availability of information online.
22:05
So speaking really practically about what a company should do,
22:09
we need to start with a baseline.
22:10
So I mentioned that any program or any mitigation needs to be
22:15
really addressing the real risks that face you as an executive.
22:19
So we almost always recommend organizations conduct what we call a
22:24
digital risks profile review for their key executives and family members,
22:28
cause family is quite important in this.
22:30
The threat actors as we call them, often use family information
22:35
as a way in, so including the executive's entire ecosystem.
22:39
And these reviews map an executive's digital footprint and give a baseline.
22:45
So social media exposure, deep and dark web searches, any leaked
22:50
information, and other kind of vulnerabilities that might appear.
22:53
And then we would couple that with a residential security review.
22:57
So looking at the physical risk profile and a digital risk profile.
23:02
But to your point, it changes really quickly.
23:04
So setting that baseline, setting a program around that overall
23:09
risk assessment, including both the physical and digital worlds.
23:13
And then setting up monitoring that is geared towards identifying any
23:18
indicators of a spike in activity or negative sentiment or increased
23:24
threats or the potential for increased swirl and vitriol in an adjacent
23:30
area to spill over to that executive.
23:32
So the threat monitoring around this and the trying to predict changes
23:36
in that threat and risk environment has become quite sophisticated.
23:41
Yeah, it really is a new world.
23:43
So, final thoughts on what you would recommend in this period of
23:47
time, for the next year or two.
23:48
What should boards and executives focus on?
23:52
Yeah, I wish I could say that things are going to get better from
23:54
a threat perspective, but I don't think it's a great news story.
23:58
Political polarization is, I think the indications are certainly it's
24:01
not getting better anytime soon.
24:04
Businesses generally, and executives in particular, will still be caught in the
24:10
middle, along with other public figures.
24:13
And then from a threat actor perspective, we're going to see more capability for
24:18
threat actors to manipulate, to spread disinformation, to access executives
24:24
and their families, to divulge personal or proprietary information
24:28
via cyberattack, et cetera, et cetera.
24:30
Their capabilities will continue to be enhanced.
24:34
And then last, I think we're seeing a continued acceleration of geopolitics
24:39
and geopolitical rivalries and flashpoints accelerating those risks.
24:45
So the challenge on leadership is going to be for them to really stay
24:49
ahead of the risks and, not just be forced to react and that creates
24:54
what is going to be a mindset shift.
24:55
And so that's a mindset shift from executive security as a kind of a
24:59
niche thing and stovepiped, into a strategic risk and governance
25:04
issue that needs accountability to the executive team and the board.
25:09
And to look at it as part of that bigger picture.
25:12
Yeah, well-stated.
25:13
It's not about just the CEO when he or she travels to a remote location.
25:18
It's about every day, and it's about the company, it's about employees,
25:22
it's about the entire team.
25:24
Bill Udell, thanks for being with us today and sharing these great insights.
25:30
Thank you, Steve.
25:31
And thanks to all of you for listening to C-Suite Perspectives.
25:35
I'm Steve Odland, and this series has been brought to you by The Conference Board.