Michael Tran Duff has spent nearly 15 years leading cybersecurity at Stanford and Harvard. His message to founders and CEOs: You may not prevent every cyberattack. But what happens next is a leadership decision.
It took about 30 seconds.
A convincing phone call. A familiar-looking website. A request to verify an account. An employee entered a password, approved a multifactor authentication request, and unknowingly handed an attacker access to sensitive information.
The attackers hadn't defeated an elaborate technical defense. They had persuaded someone to open the door.
For Michael Tran Duff, the incident reinforced an uncomfortable truth: even sophisticated organizations cannot rely on people making the right decision every time.
His response was to push toward passwordless authentication. Among employees using the new approach, he reports that account compromises have dropped to zero.
But the larger lesson goes beyond passwords.
Cybersecurity is no longer simply a contest between hackers and technology. It's a test of how organizations are designed, how leaders make decisions, and how they respond when defenses fail.
The attackers only have to be right once
Duff describes today's cybersecurity environment as the most dangerous he has encountered.
"The adversaries only have to be right one time," he explains.
Attackers need to find a single vulnerability. Organizations must protect countless entry points across employees, devices, software, and vendors.
For founders who assume their companies are too small to attract attention, Duff has a sobering observation.
"Most attacks are targets of opportunity. They don't care who you are."
A ten-person startup can be as attractive as a multinational corporation if it presents an accessible weakness.
And artificial intelligence is changing the equation.
Duff describes how AI is making sophisticated attack capabilities available to a far broader population.
"Almost everyone has the capabilities that only nation-states used to have," he warns.
AI can help attackers identify vulnerabilities, create convincing phishing messages, and impersonate trusted individuals. A fraudulent email can reproduce an executive's writing style. A phone call can sound like a familiar colleague. A video conversation can feature a face that appears authentic.
The traditional warning signs are disappearing.
The challenge is no longer simply teaching employees to recognize suspicious messages. It's building processes that remain secure even when a fraudulent request appears legitimate.
Your biggest vulnerability may belong to someone else
Modern organizations depend on external providers: cloud infrastructure, payment processors, customer management systems, payroll platforms, and specialized applications.
Each connection creates efficiency. Each can also introduce risk.
Duff emphasizes that companies often understand their immediate vendors but have far less visibility into the suppliers supporting those vendors.
He calls these fourth- and fifth-party dependencies.
A company may select a secure technology provider without realizing that provider relies on another company whose systems are vulnerable. A single weakness deep in that network can affect hundreds of organizations simultaneously.
For founders, this creates a difficult reality.
A startup can follow recommended security practices, invest in reputable technology, and train its employees—and still be exposed through systems it neither owns nor controls.
Duff believes startups are generally better served by established cloud infrastructure than by attempting to build and secure everything themselves.
But choosing a respected vendor isn't the same as understanding the risks.
Leaders need to know which systems are critical, where dependencies are concentrated, and how their businesses would operate if an essential service became unavailable.
The question isn't simply whether your company is secure. It's how much of your security depends on organizations you may never meet.
The uncomfortable limits of prevention
Cybersecurity has traditionally emphasized prevention: stronger passwords, better firewalls, sophisticated detection systems, and software updates.
All are important. None is sufficient.
Duff describes incidents in which attackers exploited previously unknown software vulnerabilities before security patches were available.
These zero-day attacks expose a fundamental limitation of even sophisticated defenses.
An organization cannot install a fix that doesn't yet exist.
Nor can it guarantee that every employee will recognize every attempt at deception, particularly as AI makes those attempts more convincing.
Duff advocates multiple layers of protection, sound technology architecture, disciplined patching, and established security frameworks.
But organizations must also plan for those defenses to be breached.
Instead of treating cybersecurity as a problem that can be solved through sufficient investment, leaders must understand it as a continuing business risk.
The objective becomes not only reducing the probability of an attack but limiting the damage when one succeeds.
When the breach happens, the clock starts
Imagine discovering that attackers have accessed your customer database.
Your technology team is investigating. You don't know what information was taken. Customers may be affected. Regulators may need notification. Your board wants answers.
What do you say? Who makes the decisions? How much can you disclose when investigators are still trying to understand what happened?
For Duff, this is where organizations discover whether they have prepared for a crisis—or merely prepared a document.
He argues that incident response plans must be operational checklists, not lengthy manuals that become impossible to navigate under pressure.
Who contacts outside counsel? Who engages forensic investigators? Who communicates with customers?
These responsibilities should be established before an emergency.
Duff recommends identifying specialized outside advisers in advance, including legal counsel and forensic investigators.
The plan also needs testing. A document never rehearsed is little more than an assumption about how people will behave when everything goes wrong.
Determining what happened and whose information was affected can take weeks or months.
Yet the pressure to communicate is immediate.
Executives must make decisions while information is incomplete, knowing those decisions may be scrutinized later.
This is no longer primarily a technology problem. It's a leadership problem.
The difference between a breach and a crisis of trust
Perhaps Duff's most consequential observation concerns what separates organizations that recover from cybersecurity incidents from those suffering lasting reputational damage.
"The differentiator is your communications," he says. "That'll make or break your business."
It's a striking statement from someone whose career has centered on protecting complex technology systems.
But a security incident is an event. A loss of trust can become an enduring business problem.
Customers may understand that even well-protected organizations can be attacked. They are less likely to forgive an organization that appears evasive, disorganized, or indifferent.
Duff emphasizes timely communication, transparency, and regular updates.
That doesn't mean speculating about unverified facts or making promises that cannot be kept.
It means acknowledging the situation, explaining what is known, being clear about uncertainty, and demonstrating accountability.
For founders, the stakes are especially high.
An early-stage company may have spent years earning its first major customers. Those relationships often depend on personal confidence in the founder.
One poorly handled incident can put that confidence at risk.
A breach can damage systems. A mishandled response can damage the business itself.
The CEO cannot be the exception
Duff argues that cybersecurity culture begins at the top.
He describes problems created when senior executives demand exceptions to security requirements, treating rules designed to protect the organization as inconveniences that apply to everyone else.
Employees notice what leaders prioritize. They also notice what leaders ignore.
If security is routinely sacrificed for convenience, that becomes the organization's actual policy, regardless of written procedures.
Duff urges founders to make sound architectural decisions early, when systems are relatively simple and changes manageable.
He also advocates board-level support, clear ownership of risk, and appropriate security expertise, including fractional leadership when a full-time chief information security officer isn't practical.
But one of his most revealing recommendations is surprisingly simple.
Stop keeping information you no longer need.
Duff observes that many serious data breaches involve information organizations had little reason to retain.
Companies accumulate customer records, employee files, and historical databases because storage is inexpensive and deletion requires decisions.
Yet every retained record represents potential exposure.
Information securely deleted cannot be stolen in a future breach.
Sometimes cybersecurity isn't about adding technology. It's about deciding what the business no longer needs.
The real measure of leadership
Duff's message is not that cybersecurity is hopeless. It's that traditional assumptions are becoming obsolete.
AI is expanding attackers' capabilities. Technology networks are creating vulnerabilities beyond any single company's control. Even sophisticated defenses can fail against unknown threats.
The organizations best positioned to survive won't necessarily have the largest cybersecurity budgets.
They'll be those whose leaders understand their risks, make intelligent architectural choices, prepare their teams, and communicate credibly when something goes wrong.
For founders, the opportunity is to build those capabilities before the company becomes too complex to change easily.
For established executives, the challenge is recognizing that cybersecurity belongs in the boardroom as much as the IT department.
When a cyberattack occurs, the technical team may be responsible for containing it.
But the decisions that determine whether customers stay, employees retain confidence, and the business emerges intact belong to leadership.
The breach may be beyond a CEO's control. What happens next isn't.