What makes cybersecurity in this area so difficult, and are there any ways to make it easier?

Woodfield: We rely on partners a lot, right? We need payment processors, banks, and you have regulatory stuff, but there’s a lot of vendors involved with that as well. Working on those partnerships, that’s nice to put things on paper, but paper controls don’t protect your loss as much.

If you’re using APIs where there’s not human intervention, you can do things built into the API. You can put protections in there, you can update the API with partners, and that’s immediate and built in. But there’s still going to be manual interactions. People are going to have portals to do stuff and look at things, but people don’t want to use portals as much. They want to be able to tap a phone and just do things. 

I think the move to people not wanting to go to portals is going to help be able to do things more in an automated way quickly, and that is one of the ways to constrain the effects of fraud—and to be able to do it dynamically. 

Feedback loops on AI are okay, but some AI LLMs are trained with a knowledge date: a cutoff date of their knowledge from version to version, even though they’re taking in new data and still training for the next version. It’s not immediate. There’s still a lag. There are some learning capabilities, and that’s what people are working on as they go along. 

So there’s still going to be people—whether it’s in fraud or financial planning—that’ll have to manually deal with the strategy and how to approach different concerns. Even after you select those choices, they take a while to be implemented. There’s always a delay, and it’s hard to do this. 

I think every once in a while, there’s something that motivates changes in applications, APIs and regulations all at once to say: ‘Okay, we’ve seen this enough. We have to do something about it.’ But that doesn’t happen now. Everyone’s doing their own thing, whether it’s the U.S. versus the EU doing different regulations, or it’s a focus on consumer rights. Open banking is a big concern, not only [because] you’re going to be sending financial data all over the place, but also because it costs money. 

What should somebody in charge of tech and security make sure their CEO and CFO know about moving forward with electronic payments?

[There are] multiple facets. There’s the payment channels themselves that you have to worry about, and you absolutely must get on the automation and AI bandwagon. The adversaries are going to be using it and you can fall behind, so learn AI and embrace it, learn how you want to constrain it. 

Partner with strong partners that will do that for you as well. Third-party risk is the bane of my existence, but it is very important to have these partners because they focus on certain issues. They are there because they’re experts in it. And if you don’t do it, you’re going to have a big cost to bring it in house. 

When it comes to general cyber protections, phishing is the root of all evil. Stats say from 70% to 90% of ransomware has really started with phishing. Business email compromise [has also] evolved. Now it’s focused on vendor email compromise—about twice as often as business email. All that starts with phishing. On the enterprise side, [your job] mostly is to make sure your employees aren’t doing bad things. If your employees get compromised, then your systems could get compromised. 

A lot of that focus on phishing is just security awareness. We repeatedly send things out to our employees, even if it’s more of a personal thing, not a business-related security issue. We’ll send articles and other things to them constantly to put them in the mindset of thinking in a secure manner. We leave it open. This is a no-judgment zone for us. If people think they did something, you just tell us. We’re not going to yell at you. People report stuff to me all the time, and we encourage that security culture. Building a security culture, especially to protect yourself from phishing, is the No. 1 thing to do to protect your business. 

From an application perspective, a lot of people are in the cloud now and they don’t necessarily have good cloud protections. The CSPM and CWPPs have evolved into CNAPP. It’s a cloud native app protection [platform]. It’s the full bubble of cloud protections: not just your infrastructure protection and monitoring, but protecting your workloads as well. 

You’ve got to have good cloud protections. A lot of people think you put it in the cloud, it’s all done. It’s not quite that easy. You still have to monitor, and monitoring is probably the hardest part of all the cyber worlds because it’s a lot of data to go through.

There are so many issues that are coming up with payments: payments in general, payments by different methods, payments across borders, different national and geopolitical protocols that need to be followed. And identity means something different everywhere you go. What do you see as the solution, and do you see it as something that gets resolved in the near future?

The technical stuff is the same as always has been done for technical solutions: You analyze a problem, you gather data, you put out a solution and see how that works, and you keep doing that repetitively. It’s a circular effort of improvement. From the business side, you should be involved with that. 

I think there sometimes is a disconnect on the technical side and the business side. Make sure that you see when you’re making certain changes: How does that improve your bottom line? Does that reduce your fraud cost? CFOs have always had a problem with fintech. They’ve got that balancing act of trying to figure out how much to balance spend to combat fraud: This new tool will save us $1 million when we had $2 million of fraud before and then it cost us half a million.

Okay, that’s great. It works out. But the old saying is, you don’t put a $10 fence around a $1 cow. You can’t afford to throw tons of money at this. You’ve got to do this iteratively, technologically or financially. The key to this is the financial side should know exactly what you’re doing in your fraud programs and your technical programs so you can quantify how it has affected your bottom line. Then you just have to keep doing it. 

I don’t think it’s much different than normal. It just happens so much faster right now. This is why we have to pay attention to AI and automated techniques: You have to embrace those, or you’re going to fall behind business-wise.