Name: How COOs Manage Risk When Threats Multiply
Uploaded: 2026-06-01
Duration: 19 min 12 s

The assassination of a Fortune 500 CEO last year was a stark reminder of what enterprise risk managers have long understood: the threats facing organizations today are no longer siloed. Data systems face AI-driven attacks. Supply chains fracture along geopolitical lines. Executives become targets for violence. The COO often sits at the center, responsible for protecting people, operations, and continuity across a threat landscape that keeps expanding. Risk advisory firm leaders Jacob Silverman, CEO of Kroll, and Sid Kosaraju, president of Crisis24, bring decades of expertise in elite enterprise risk management and executive protection at a time when these challenges are more critical than ever. In this session, hear how they assess dangers, make critical recommendations, and build organizations resilient enough to survive whatever is thrown their way. 

Sid Kosaraju, President, Crisis24
Jacob Silverman, Chief Executive Officer, Kroll
Moderator: Ruth Umoh, C-Suite and Leadership Editor, Fortune; Co-Chair, Fortune COO Summit

How COOs Manage Risk When Threats Multiply

Conferences

Good afternoon everyone. Welcome, welcome to my esteemed panelists. Let's kick things off with a quick show of hands. How many of you believe you're operating in a more volatile environment today than you were 5, 10 years ago? Please raise your hand. That's a sizable share. I'd say that's the majority of attendees in this room. Sid, Jake, are they in fact accurate? Is this a more volatile movement than we've seen in years past, or this is the risks are more visible, faster move? What are your thoughts? Uh, thank you for having us here. Uh, we, we definitely feel from our perspective that it's a, it's a more risky environment out there than it ever has been before. Uh, the global environment is different. The geopolitical situation is different. The business climate's different and I also feel we've been talking a lot about AI and the rise of AI, a lot of benefits that come with it, but there is a segment of the population that feels disenfranchised and disintermediated by it, and that's leading to frustration and to events that I don't think I would have foreseen. Um, 5-10 years ago where there's actually been violence that's come from it and all of these things are, I think, um, leading to a more complicated environment than we've ever been in before. Jake, what are your thoughts? I would completely agree. The term that I use, and I try not to use acronyms too often, is VUCA. I don't know if people are familiar with that term. Anyone know the term VUCA? You got two of them, VU, uh, the volatility, uncertainty, complexity, and ambiguity. You got it. Um, it's just a great way of framing the concept that none of us have a clue what's gonna happen tomorrow, next week, next year, um, and I use this term for our own professionals and for our clients to basically frame the idea that you have to be prepared to operate in what I call a VUCA world. And the world feels a lot more VUCA now because it is more in large part because of the themes that that Sid commented on, uh, the, the connectivity of the world. We are completely interconnected on a, on an hourly if not minutely news cycle, and the ability for threat actors to take advantage of that cadence combined with technology makes it a much more VUCA environment. So both of your points, I think one of the biggest. Challenges right now is that every threat feels so urgent cyber security, executive safety, AI misuse, geopolitical exposure, uh, supply chain fragility everything feels mission critical all at once. How are the sophisticated organizations you're working with distinguishing between what is simply noise and what is the true existential risk for the company? Part of the reality of operating in a VUCA environment is is to understand that there is a lot of noise, but you can't let your guard down. You have to figure out a way to sift through the noise and the only other acronym that I'll use is is TEV. A lot of people. Think of that as total enterprise value, so protecting your equity value. I think about it as training ecosystem vigilance and security is an ecosystem. It's an interconnected organism. You have your, your, your host organization and all of the third parties and stakeholders that are connected to it and the key in my opinion with regard to protecting and making the house as resilient as possible is training. Recognizing that interconnectivity that it is an ecosystem and remaining vigilant, so you have to be able to understand that there's noise and sift through it so let me turn to you, uh, as you already alluded to, we've seen a real escalation and threats targeted. Uh, senior executives, CEOs, we saw with Tim Altman recently, obviously United, um, Healthcare just a few years ago seeing it certainly on the political stage and multiple times. How are boards and executive teams thinking differently about executive protection today compared to even a few years ago? What's changed? Uh, it's a great question. I think they clearly are taking it more seriously. Um, I think one thing that we've seen taking place more is usually it's either under the, the, um, auspices of the chief risk officer or the chief operating officer, but they are, um, business resiliency teams or a team that has been put together and they look at enterprise. resilience as something they do every day and it's, it's always on intelligence in terms of feeding geopolitical and what previously used to be head of state grade security intelligence information that's continuously coming into the business resiliency team and they're sifting through that trying to find the signal from the noise um and actually feeding that information real time to the C-suite to the board members. I mean this is interesting they'll have devices where real time they're getting. Intel assessments that are coming from around the world from teams usually their partners because it's tough for any one corporation to staff this but former three letter agency CIA FBI type grade of intelligence analysts that are feeding this intelligence to them and to their executive protection teams so that they can handle as Jake was saying before, we don't know what's coming our way, but when you have this infrastructure through a business resiliency team you're better apt to not just. React but to know the structures in advance such that you're not losing time between uh understanding and responding. Please go ahead. I would just add that it's not the act of protection does not stop when people leave the office. Um, it extends into their personal lives, their family lives. One of the biggest points of vulnerability is not the executive, um, you know, him or herself, but their family members, their use of phones, their interaction with social media, particularly kids, um, and threat actors will exploit all of these vulnerabilities in someone's ecosystem, to use that term again. If I could just make a point, Jake is so right. I mean, they, the point of least resistance sometimes is the families, and, uh, I, I will just use myself as a personal example. Um, one of the areas that, uh, is, is looked at from a, a weakness or, um, a threat perspective is the cyber lens. And the first thing I had done when I joined the organization two years ago is I said run a cyber assessment, let me know kind of what my threat levels are, and I found that, I mean I was, I was happy. I seemed to be pretty well protected, but I have 3 children. My 12-year-old daughter doesn't even own a smart device, and the report showed that they, the threat actors, and this was friendlies, right, ethical hackers on our team that were able to pinpoint in 2-hour increments where my daughter was every day. Because they could get into the school website, they could get into the, the tennis, uh, club website and pinpoint and usually what happens is the, the threat actors are going to target the children. They're going to target the elderly parents and, um, you know, sorry to say here right in this state of Arizona we had the, the Guthrie incident. I mean these are things that are increasingly people are looking at is it's not just the principal, it's the family as Jake mentioned that you have to protect against and I think corporations are going to that point where they're protecting the C-suite, the, the, the executives and the families because they know where the threats are. Yeah, let me ask you this. If you're advising, let's say a smaller mid-sized company, they don't have a Fortune 100 security budget, what's the minimum viable level of preparedness every company should have? The MVP, oh, that's my last acronym, you know, for, for, for any business, uh, it was a very difficult question to answer, but it starts with understanding what type of culture are you as a business because you could be the, if you're a business who is Focused on protecting every element of your infrastructure with uh with physical infrastructure and cyber infrastructure um you know that that reflects the culture of your business you're closed off um if you're a company often entrepreneurial companies who are eager to be open. Um, you have to make some sacrifices in terms of freedom, so the MVP of, of any businesses' security profile really depends on what type of company you're prepared to be. There's a trade-off, a very important trade-off that every company has to assess between, uh, freedom and security. And finding where you fall on that balance is something initially that every company no matter how large or small, have to assess. I just had one quick add to that. I think that's absolutely right. I would also say, um, Jake and I were together with a group of board of directors earlier in the year. And it was interesting, um, we, we saw some public, um, publicly published data where in 2023, if you can believe this, the top 100, um, publicly listed companies by revenue size, their average spend on security for their, uh, C-suite. Was under $100,000 a year. That's the medium. In the last two years, you can imagine the orders of magnitude it's increased, but to Ruth, to your point, what we've seen, the easiest things to do, and it doesn't take millions of dollars, but it's enabling secure transportation. You'd be surprised, it's not very much more than an Uber, but when you have directors and you have executives that are taking Ubers or just transportation where you don't know who's driving you and what, what the protocol is if something happens. Uh, secure transportation number one I would say is a minimum. I would say also on the cyber side, I mean you'd be surprised C-suite and sometimes even board members using personal emails to transact company business back and forth, specifically board of directors, get them all on company email, and then I would say that the next thing is just that always on intelligence. It's not very expensive to get this intelligence service by partners, you know, where they will be feeding this to your company, so you're just smarter about what risks you're facing. There's, there's no shortage of now 24/7 social media monitoring, reputation monitoring, all of the above. What I, I would just add to what Sid said, and he's absolutely right, that the, the minimum sort of act of engaging in security as a company comes back to culture, to a certain extent budget is training, training. And vigilance around the idea that security is part of sort of the cultural mindset of of your business so you know the weakest link is always a person. Let's talk about the weakest link moving beyond the physical threats to digital threats. AI is obviously making deception cheaper, faster, certainly more convincing when you're. Employees, when your customers, even when your fellow PR executives can no longer assume that even an email is real, what has to change operationally inside companies? You're talking about training. What, what, what more? Let's get a little bit more granular. I can't tell you how many times Jake Silverman asks for billing information at Kroll. OK, it probably happens every day. Uh, and now with, with, uh, the ability to do real, you know, deep fakes with AI, uh, it's all that the more dangerous, uh, there, there's technology that can root it out, and there's a whole level of, of, of literally filtering out deep fakes and phishing that happens in your firewall, but the last line of defense is always a person, so I can't emphasize enough. You know how to recognize the tells of the rudimentary fishing, uh, exercise or a more complex one, and my people are texting me or teasing me or or WhatsApping me all the time. Hey Jake, I know this isn't you, but I wanted you to know. Training, yeah, I think that's a great point. I would add to the training. Um, what we have seen that's been effectively utilized is companies will always say if you see something suspicious, you know, put in a phone call, and the CEO will even, uh, the office of the CEO will take those phone calls, and it's almost like you change your password every month. There's a password, and when you're having that phone call, there's a password and you say password. Uh, jinx and then you know it's, it's authenticated and that conversation is real and it can verify if the email was secure or not, but these are things where you're just simple things but you, you use and it really can. Can really protect a lot. Yeah, uh, I wanna throw another question at you, Jake, before I do, just a quick heads up for the audience. We will be turned in to take questions from you. So please, please consider some questions. We have mic runners in the audience. I think that the interesting paradox here is that while AI certainly is increasing the risk environment, it may also give leaders better tools to also detect the crisis. So how are you hearing from COOs about how they should think about using AI to anticipate, um, operational threats well in advance? Any signals? Uh, it's definitely being used and, um, we're not, I'm not saying this to tout our own horn or anything like that, but we partner with Palantir, we work with their, um, their foundry technology, and we have an AI solution which with our, our clients they can leverage, but in essence, um, some of our team members who used to be with CIA who used to write the presidential daily brief for the president of the United States, they bring that to this AI platform and in essence what it does is every day it delivers to the CEO of the corporation. Um, the equivalent of a presidential Daily Brief and it pulls all the relevant items where that CEO's people are around the world, where his facilities or her facilities are, where their vendors are, where their supply chain weaknesses or strengths are and all that information goes in and every day the CEO is getting that report so they know, oh boy, Strait of Hormuz is closed today. I better start sourcing my goods. Supply chain out of Bangladesh or somewhere else, but that's the level of intelligence that corporations are now taking it to, and AI is fueling that which is pretty amazing. It's also, uh, really helping to drive workflows. We have at Kroll a workflow solution around security remediation and leaving an audit trail, uh, called Resolver, and our Resolver product is. Is AI enabled AI power to really ingest lots of the information that Sid is referring to to make the risk managers, uh, life that much more efficient and accurate in terms of really running a remediation with regard to a security breach. Accuracy is key. Uh, any questions from the audience, please raise your hand and someone with the mic will come over to you. Any questions? Anyone? Alright, let's keep going. Uh, even just a few years ago, I feel that many companies treated geopolitics kind of as background context. Uh, today it obviously directly affects operations, pricing, sourcing, shipping routes, case in point, uh, Strait of Hormuz, as you just noted, how can COOs practically stress test their organizations around these kinds of scenarios? What are you seeing that works? Well, I think first, and this will sound, I don't mean to sound patronizing to anyone, but everyone has to know what's going on in the world, and it used to be if you're in a business in a particular lane that what's happening in, uh, in an election in Hungary or in a geopolitical, uh, interaction in Southeast Asia might not matter to one's business if you're in Omaha. The truth is because of the interconnectivity you have to know what's happening in geopolitics and in politics that might be in far flung parts of the world because it will have a ripple effect and it will have a security implication there is no question about that because when there is uncertainty geopolitically threat actors emerge not just there but elsewhere around the world. Yeah, I would, I would echo that completely, and I would also say that um when, when we think about this, the world is so interconnected and these threats and these risks are interconnected. There's not, there's no silos anymore. And so when you have something that is a a physical threat, it usually is linked to a supply chain threat which is linked to uh a business threat and linked to a cyber threat, and they all come together at you at one time. I would say we found is that COOs, C-suite that are really on the front end of the curve on this, they're really linking three concepts. They're saying, OK, we need to have a strong business resiliency function within the company and not to say we have to do it all. They'll work with partners too. Um, but then beyond that they look to having a strong crisis response function and many times that's not internal so that is if there is a need recently in the Middle East for evacuations and we need to get people out. I mean we recently worked with a uh a large technology company, um, and helped them evacuate 2000 people out of the UAE. When the Iran crisis started, but I mean no one company can do that, so you need to have partners who can do this. So I would say business resiliency linked with a crisis response capability either internal or external, and that all ties at the other side of the spectrum with strategy, which is what we're talking about strategically what's happening geopolitically, how does that inform my business resiliency strategy and my plan. And then also having almost like a racy chart knowing when this happens this person's responsible and this is what's going to happen all laid out in advance because it's too late once the emergency happens to figure this out. It's also really critical in this VUCA world in this geopolitically uncertain world to understand the different forms and archetypes of threat actors. Um, it's not just, you know, often times in, in, in the corporate world you think that there's criminal actors who are seeking financial gain. Now there's ideologues and we've seen tragic consequences of, of that. There are political actors and then of course there are internal actors and some of the biggest threats, uh. Purposeful or inadvertent come from within the walls of all of our organizations and we have to be able to be unfortunately very focused on that as well. Jake, not only do you have an affinity for acronyms, you also have an affinity for metaphors. Use the term gray rhino, those visible but underappreciated threats. What do you think those are these days? Well, I just referred to one, you, you have to understand the threat actors that are in front of you sometimes they're inside your house. Um, and you know we talked about Black Swan being a once in a lifetime event. The gray rhino is staring you right in the face and can really run you over, and you're staring in that person's or in that theme's face every day. So sometimes it's the innocuous little things, the little tells, um, the, the, the slight vulnerabilities in your organization or the untrained person who can cause catastrophic impact. You seen any gray rhinos? Not too many to say. Well, listen here, if we're having this conversation 3 years from now, what do you think will have changed most dramatically about how companies think about operational resilience? I would say first and foremost it's not an afterthought it's gonna be front and center because in the in the environment we're in, I mean we all hope for the world to become like it was and more peaceful than what it is today, but the reality of the matter is every day it just seems like it's more uncertain than the last and I. I think um these elements we've been talking about will become more of a focus as opposed to, oh my gosh I, I'll get I'll be ready for it when it when it happens. I completely agree. In 3 years' time, VUCA will be a board level term that everybody will get t-shirts exactly Sid Jake, thank you so much for an insightful conversation. This was great. Thank you.