The Cyber Health Company

We’ve built a proprietary measure of personal cyber risk. Read more about our Cyber Health Score At The Cyber Health Company, our raison d’être is to minimize the likelihood that personal compromises harm people and their firms. You cannot mitigate risk unless you measure it. As such, the first step in our onboarding new members is to quantify their risk of falling victim to various compromises. We’ve identified the most common and impactful threats and the underlying data points that determine your risk for that threat. For example, identity theft is a common threat and “is your credit frozen on Equifax” is a major determinant of your risk of identity theft. This is analogous to the biomarkers that the longevity community is tracking for measuring aging. We track over 205 unique data points across threats. Then, in our work with high risk individuals, we focus on flipping those data points that are lacking to decrease their risk (thereby increasing their Cyber Health Score). As a security professional or enthusiast, what are critical “data points” you would want to know about an individual to assess their vulnerability to a certain attack? We have many of the obvious ones covered, so the weirder the better!

Executives who use one phone, should treat Apple Intelligence with caution. It's still a black box as Apple plays catch up with OpenAI, Google, Meta and Anthropic. One Apple Intelligence overreach that may cause you to leak confidential corporate information is "Summarizing Notifications." Apple is applying its intelligence on your notifications, to "analyze the content for importance." I can think of no greater repository of confidential information than your email, which is on your phone and produces a lot of notifications. If you're an executive using one phone, I'd consider turning this feature off. Steps: Settings > Notifications > Apple Intelligence > Summarize Notifications > Toggle off

Cybercrime statistics are eye-popping, but likely still understate the magnitude of the problem. It's MUCH more common than you think. The FBI’s 2024 IC3 Report logged 859,532 complaints and $16.6 billion in reported losses, a record high. These are official complaints to the FBI in calendar year 2024. But even those staggering numbers understate reality. Why? Many victims, especially executives and high-net-worth individuals, don’t report. Filling out a form is not worth the time for small problems that don't result in material loss. This minimizes the complaint count. On the higher end, (i.e. cases where this is material loss), there are many reasons victims don't report. They don't plan to make an insurance claim and spike their premiums. They have done something unrelated that is questionable, and do not want the presence of law enforcement. If a ransom request is handled through private remediation or crypto wallets, it might never reach IC3. Cross-border scams are also difficult to track as this is a domestic agency. The FBI itself notes many of these shortcomings. Meanwhile, recent reporting shows how much is missing from “official” data: -The DOJ just seized $15 billion in bitcoin tied to a massive pig-butchering scam (https://lnkd.in/e4TUk8vv) -Chinese gangs have stolen over $1 billion through text-message and URL scams targeting U.S. individuals ((https://lnkd.in/eCU3sdQk) Our view is the problems is 2-3x bigger than reported --> this means millions of victims each year and tens of billions in losses. The smartest companies are investing in executive #cyberhealth before the problem hits home. We're here to support companies in that proactive posture.

Many executives ask about how about how to securely connect when traveling. With legitimate network security concerns, this is an important #cyberhealth topic. Here is our framework: If you are in a location with cell service: the answer is simple, use a hotspot from your phone. Do not connect to another network, even if the business or host is reputable. Expense the higher than normal data charges, if necessary. Should you catch pushback, ping your CISO. They will be delighted to defend you. (On an iPhone: Settings > Personal Hotspot > Allow Others to Join > On) If you are without cell service (a remote hotel or an airplane): the calculus is trickier. The equation is now 'no productivity but secure' or 'productive but assume some risk.' Behavior is more art than science. There is clearly urgent work that may be worth the marginal risk. Avoid typing credentials or opening material non-public information. However, if something can wait, we recommend waiting. Not every WiFi network is compromised or operated by a bad actor. The safe assumption is someone is reading over your shoulder. Act accordingly.

Your leadership is your most valuable asset. We're here to protect and empower them. We understand that cybersecurity isn't about building walls or moats, but about building strength and resilience. That's why our Executive Cyber Health Score provides a personalized roadmap tailored to each executive's unique digital footprint and security risks. While your security team works hard to protect the enterprise, we'll cover personal cybersecurity for your leadership team: - Personal devices - Cloud, email, and online accounts - Social media risks - Mobile apps, including finance We also offer 27/4 concierge support because we're not just here to point out issues -- we're here to answer all of their questions, day or night. Imagine a leadership team that's not just protected, but fluent and confident in their cyber health. Let's have a conversation about building true resilience.

Salesforce has made it clear, they are not paying the ransom. This puts even more pressure on executives at affected companies. As a reminder, Salesforce's product Drift was breached last week and 1 billion records were exposed at various customers - FedEx, McDonalds, UPS, Chanel, Home Depot among others. Seeking to monetize their work, attackers demanded a ransom from Salesforce to be paid by 10/10 (this Friday). As of yesterday (10/7), Salesforce has officially refused to pay with an official message relayed by comms pro Allen Tsai. "We are fully aware of the extortion attempts and remain in contact with affected customers to provide necessary support: Attackers are becoming increasingly impatient and resorting to more desperate tactics: putting up a bounty program to go after the executives of Salesforce customers who were impacted. This means if you're an executive at the affected companies below, attackers are paying crypto to anyone who can offer your personal information. AAA. Adidas. Aeromexico. Air France. Albertsons Companies. ASICS. CarMax. Cartier. CHANEL. Cisco. Engie. FedEx. FUJIFILM Holdings America Corporation. Gap. Google. HBO. HMH. Hulu. IKEA. Instructure. Instacart. Kering. KFC. Marriott International. McDonald's. Pandora. Petco. PUMA Group. Qantas. Republic Services. Saks Fifth Avenue. Stellantis. The Home Depot. Toyota Motor Corporation. TransUnion. TripleA. UPS. Vietnam Airlines. Walgreens. As the deadline approaches, we expect doxxing and harassment to increase. Let us know if we can support your in any way.