The AICPA & CIMA fireside chat on Cybersecurity for the Digital Transformation Era made one thing clear:
“Cybersecurity hasn’t just evolved. The rules have changed”.
What used to be a conversation about endpoints and controls is now a conversation about people, identity, behavior, and decisions made at speed. Across the panel, a consistent theme emerged. The biggest risks today are not just technical gaps, but the way organizations operate within increasingly complex and fast-moving environments.
Key Takeaways: Where Organizations Are Getting It Wrong
The discussion highlighted a shift that many teams still haven’t fully internalized.
- Cyber risk is no longer contained. It spans workflows, AI tools, user behavior, and automation. AI is accelerating both productivity and risk, often creating consequences teams didn’t anticipate.
- A recurring theme was false confidence. Organizations trust tools they don’t fully understand, rely on detection they haven’t validated, and assume processes will work without real testing.
- At the same time, the cybersecurity space is getting noisier. With constant claims and evolving threats, “trust but verify” is no longer optional. It’s essential.
Raymond Cheng’s Contribution: Bridging Compliance and Reality
Raymond Cheng brought a practical, audit-driven perspective.
His message was clear.
“Compliance does not equal readiness”.
Organizations invest in frameworks, but struggle with execution. The gap isn’t documentation. It’s how systems and people perform under real conditions.
He illustrated this with a simple example. An AI email assistant drafting replies automatically, including ones that should never be sent. A small issue on the surface, but a clear signal of how quickly risk scales when tools are not fully understood.
He also highlighted a growing challenge, “Identity sprawl and lack of traceability”. As AI and automation expand, it becomes harder to answer a basic question: “Who is actually doing what?” This shifts security toward governance, visibility, and accountability.
The Bigger Message
There are no silver bullets.
“Cybersecurity today is about clarity, discipline, and decision-making”.
It’s about understanding risk, challenging assumptions, and building programs that work beyond the checklist. For advisors, the role is to bring clarity, not complexity.
Final Thought
Security that looks good on paper is easy. Security that works in reality is something else entirely meaning compliance proves you prepared, incidents prove whether it works. That’s the gap this conversation exposed and the one organizations can no longer afford to ignore.
