The modern corporation faces a precarious reality where traditional regulatory adherence is being rendered moot by digital vulnerabilities, forcing compliance officers to bridge the gap between legal frameworks and cybersecurity resilience. This shift in perspective took center stage at the 25th annual SCCE Compliance & Ethics Institute in Orlando, where federal officials delivered a sobering message: a company that fails to secure its data is fundamentally failing to comply with its own internal policies and external legal obligations.
The assertion, brought forward by Josh Goldfoot, a deputy assistant attorney general in the Department of Justice’s (DOJ) Criminal Division, marks a pivot in how the federal government views the role of the compliance professional. Historically viewed as internal "cops" tasked with auditing behavior and preventing employee misconduct, compliance officers are now being repositioned as the architects of organizational integrity. In an era of rampant digital threats, Goldfoot argues that the integrity of a company’s data—and by extension, its cybersecurity posture—is the bedrock upon which all other ethical and legal compliance rests.
The Escalation of Cybercrime and the AI Factor
The urgency of this mandate is fueled by a staggering increase in cybercriminal activity. According to the FBI’s Internet Crime Complaint Center (IC3), 2025 marked a historic threshold: for the first time, the agency logged more than 1 million complaints in a single calendar year. This represents a significant surge from the 860,000 complaints recorded in the previous year, with total financial losses associated with these crimes reaching nearly $21 billion.
Much of this acceleration is attributed to the democratization and refinement of artificial intelligence. Jason Cromartie, special agent in charge of the FBI’s Cincinnati field office, highlighted that AI has effectively removed the "telltale signs" of fraudulent activity. In years past, cybersecurity training relied heavily on identifying obvious red flags, such as poor grammar, disjointed syntax, or suspicious formatting in phishing emails. Generative AI has stripped these markers away, enabling attackers to craft hyper-personalized, professional-grade communications at scale.
The threat has moved beyond mere text. Deepfake technology and real-time voice cloning have introduced a new tier of social engineering. The FBI has documented cases where Fortune 500 companies have suffered million-dollar losses after employees were tricked by cloned audio of executives during sensitive periods, such as mergers or acquisitions. The "next frontier," as described by Cromartie, is agentic AI—autonomous systems that can independently identify targets, conduct reconnaissance, and iterate on attack vectors without human intervention. This evolution makes the traditional, manual defense models employed by most IT departments increasingly obsolete.
The Failure of the Human Element
Despite massive corporate investment in annual cybersecurity training modules and simulated phishing exercises, the "human element" remains the weakest link in the security chain. IBM’s 2025 Cost of a Data Breach report underscores this persistent vulnerability, noting that phishing remains the most common attack vector, accounting for 16% of all data breaches analyzed. Furthermore, Business Email Compromise (BEC) remains the second-costliest category of crime, resulting in over $3 billion in losses.
The implication for compliance leaders is that their current training strategies may be insufficient against AI-enabled adversaries. As Cromartie noted, "One person, one click can cause a lot of damage." For compliance officers, this transforms cybersecurity from a technical IT issue into a matter of corporate governance. If an organization lacks the internal controls to prevent a single employee from compromising the entire network, the company is effectively failing to protect the interests of its stakeholders, customers, and regulatory bodies.
A Chronology of the Modern Threat Landscape
To understand the current crisis, one must view it as a cumulative failure of defensive strategy:
- Pre-2020: Cybersecurity was primarily a concern for the IT department, focusing on antivirus software, firewalls, and basic employee awareness training.
- 2021-2023: The rise of Ransomware-as-a-Service (RaaS) models caused a spike in high-profile attacks, forcing C-suites to acknowledge cybersecurity as a financial risk.
- 2024: The widespread adoption of Generative AI tools allowed threat actors to automate phishing and social engineering, leading to a massive increase in volume and sophistication.
- 2025: The current year is defined by "Agentic AI" and the normalization of deepfake impersonations, creating a environment where "seeing is no longer believing."
The Compliance Department’s New Mandate
The DOJ and FBI are pushing for a more integrated approach to corporate risk. Compliance leaders, who are already tasked with overseeing organizational ethics and operational procedures, are being encouraged to exert greater influence over cybersecurity practices. This involves moving beyond the "siloed" approach where the CISO (Chief Information Security Officer) manages the technical threat while the Compliance officer manages the legal policy.
Cromartie outlined a roadmap for organizations looking to formalize this integration:
- Cross-Functional Ownership: Establish governance committees that include the CIO, CISO, Legal Counsel, and Compliance officers.
- AI Mapping: Conduct comprehensive audits to identify where AI tools are being used, what sensitive data they touch, and what inherent security flaws they might introduce.
- Human Audits: Even with automated security, organizations must implement routine, manual audits of AI-driven processes to detect bias, unauthorized data access, or technical drift.
- Strategic Oversight: Compliance officers should treat cybersecurity as a fiduciary duty, ensuring that the board of directors is fully informed of the technical risks that could trigger regulatory or ethical breaches.
The "Don’t Pay" Paradigm and Legal Risks
One of the most critical aspects of the federal message is the handling of the aftermath of a breach. Data from both the FBI and industry reports suggest that companies are increasingly hesitant to engage law enforcement when a breach occurs. IBM’s 2025 report shows that the percentage of victimized organizations contacting authorities dropped from 52% in 2024 to 40% in 2025.
Companies often fear the reputational damage or the regulatory scrutiny that might follow a public admission of a breach. Many choose to pay ransoms in the hopes of a quick, quiet resolution. However, the data suggests this is a strategic error. A 2025 CrowdStrike survey revealed that 83% of organizations that paid a ransom were targeted by the same actors again, and 93% suffered secondary data theft.
The DOJ’s position is clear: paying a ransom does not stop the blackmail. Furthermore, because many ransomware groups operate out of sanctioned jurisdictions, paying a ransom can expose a company to significant legal liability, including potential violations of U.S. sanctions law. Goldfoot emphasized that the government views companies as victims, not suspects. By engaging early—such as through the FBI’s InfraGard program—companies can receive intelligence, decryption keys, and assistance without the fear of being lectured on their past security failures.
Broader Implications for Corporate Governance
The integration of cybersecurity into the compliance function is not merely a defensive tactic; it is an evolution of corporate governance. As the digital and physical worlds continue to blur through the use of AI, the definition of "due diligence" is expanding. A failure to assess and mitigate cyber threats is increasingly being viewed by regulators as a failure of oversight.
For the compliance officer, the challenge is to move beyond the checklist. If a firm spends millions on regulatory compliance but loses its patient or customer data in an preventable AI-driven phishing attack, the compliance function has failed. The consensus among the federal speakers at the SCCE Institute is that the "big picture" view—seeing what is "around the corner as well as over the horizon"—is the new standard for modern leadership.
As the threat landscape continues to evolve, the resilience of a corporation will be defined by its ability to synthesize technical security, legal compliance, and human intuition. The message to the corporate world is blunt: the era of treating cybersecurity as an IT problem is over. It is now a core component of the organization’s ethical identity, and its failure to address it will inevitably result in more than just technical downtime—it will result in a fundamental loss of trust and legal standing.
