Fraud doesn’t always hide in the shadows. It might show up disguised as someone you know.

Like when the accounting manager gets an impromptu video call from the CFO during the company’s move to a new payroll system.

She says the new provider needs an updated employee data file ASAP and provides a new company email address.

The CFO looks and sounds right, and the request makes sense, so the accounting manager emails the file containing names, Social Security numbers, and bank account information for hundreds of employees.

Except the CFO never made the call. And just like that, the company hands over sensitive employee data to a fraudster who weaponized AI.

This isn’t science fiction. It’s happening right now to individuals and organizations alike, and it is a fitting way to conclude Cybersecurity Awareness Month. Fraudsters are creating disturbingly realistic AI deepfakes that can fool even the most cautious people, so those audio and visual cues we’ve relied on for decades are no longer reliable indicators of authenticity.

So what do you actually do about it? A few defenses worth sharing with your whole company:

And if an AI deepfake makes its way into your company, report it to law enforcement and to the platforms where the encounter took place.

Deepfakes are only the loudest example of AI changing the risk picture. The same tools that fake a voice also make it easier to misuse the data you already hold, and most companies are not ready. In IBM’s 2026 Cost of a Data Breach report, 68% of breached organizations had no AI governance policy in place, and shadow AI turned up in 43% of breaches, more than double the year before. AI-enabled attacks now account for one in four malicious breaches, and the two most common are deepfake impersonation and AI-generated malware, exactly the kind of call that opened this newsletter. The exposure is growing faster than the guardrails.

Privacy and security are peanut butter and jelly

If you know me, you know I love food and food analogies. Enter the PB&J sandwich. Peanut butter on its own is fine. Jelly on its own is fine. Who eats one of those alone? (If that’s you, we need to talk). It’s the two together that make the sandwich, and that is exactly how privacy and security work.

(Speaking of which, ever had peach rosemary jam? It’s a favorite of mine at a great place called Biscuit Head in South Carolina, and we’re always sad when the jar is done. What’s your favorite flavor?)

On their own, each team is doing good work on parallel tracks. The real magic happens when privacy and security work together. I’m quite tired of the overused phrase “better together,” but it really is true, especially in this instance.

Security defends the systems and chases the threats. Privacy knows what you collect, where it lives, how it’s used, and who gets to see it, plus all the human and business context that never shows up on a security dashboard. Keep them apart, and each one is working with half the picture. Put them together, and you finally get to anticipate a problem instead of cleaning it up afterward.

As a numbers girl, I find these supporting stats interesting. According to Verizon’s 2026 Data Breach Investigations Report, 62% of breaches involve a human element, someone clicking, reusing a password, or getting fooled by exactly the kind of call I described.

And in IBM’s 2026 report, the average US breach now costs $11.5 million, the highest of any country, driven in part by regulatory penalties. A breach is not only a security event anymore. It is a privacy and compliance event with a price tag attached.

Four places to bring the two teams together

Now, before you can make a great sandwich, you need good ingredients. For privacy, that means a current data inventory, because security can’t protect what it can’t see, and real data minimization, because the more data you hoard, the more attractive a target you become. Keep less, enforce retention, and all that dormant data stops lurking in the pantry waiting to go bad. With that in place, here are four spots where privacy and security are better together:

  1. Coordinate breach response. Build joint response templates where security identifies what breach details can be shared within regulatory timeframes, and privacy files breach notifications using these findings and updates reports as the investigation progresses.
  2. Align vendor risk assessments. Combine vendor questionnaires covering technical and regulatory requirements. Security evaluates technical safeguards alongside sub-processor security controls, while privacy assesses data usage and privacy rights to ensure contracts align. This one matters more every year. Verizon found third-party involvement in breaches jumped 60% in a single year, accounting for nearly half of all breaches.
  3. Unify cross-border data transfers. Create unified documentation that covers legal and technical requirements. Privacy documents require technical safeguards in transfer assessments, and security validates encryption, access controls, and in-transit protections that meet those standards.
  4. Implement joint AI governance. Conduct AI impact assessments with shared documentation and workflows. Privacy focuses on data minimization, transparency, and implementing privacy rights. Security covers technical safeguards, access controls, and vulnerability assessments, while bias testing.

When companies work together, they close compliance gaps and accelerate business initiatives. And the best part? This doesn’t take a reorg or a new budget line. It takes the two teams actually talking to each other (literally, actually talking!).

Download our carousel to see all the ways privacy strengthens cybersecurity resilience 👇.  

Regulations set the bar, not the blueprint

Privacy laws tell you to protect personal data. They do not hand you a shopping list of tools. GDPR asks for appropriate technical measures. State laws ask for reasonable security. California’s cybersecurity audit requirements, now in effect, will look at whether your controls actually protect personal data the way the law defines it, not just whether they stop attacks in general.

So you cannot bolt privacy on at the end. Choose security controls that also produce the evidence a regulator will ask for, map your sensitive data to the protection it legally requires (that data inventory is going to help here), and build an incident response plan that can answer the privacy questions. They include: Which categories of data are involved? How many people are affected? Where is it located? And what is the likely harm? Having a data inventory and a plan now will set you up for when something happens. Scrambling at the last minute is not a good plan.

What to actually do this month

Awareness months only matter if they turn into action, and the action here isn’t a new tool. It’s a conversation (remember the talking part above?).

Here are a few practical ways to start partnering with your security team this month:

  • Get in the same room. Set a standing check-in with your security counterpart if you don’t already have one. You can’t coordinate with a team you only email during an incident.
  • Build one thing together, not four. Pick a single joint artifact to start – an assessment, a new vendor to review, a new project, or a joint policy – and actually finish it.
  • Review your data map together. Sit down with security and walk through a risky processing activity. What’s missing from the data inventory, where does sensitive data live, and how does it move? This is also where I’ve seen teams realize how they can really support each other.
  • Connect your assessments, wherever you’re starting from. Some companies run privacy and security assessments completely separately, and some run them as one. There’s no single right setup, but there is a wrong one: two teams assessing the same system or activity and never comparing notes. The business owner doesn’t want to do these things multiple times either. Find the level of coordination that fits your company, even if it’s just flagging what each assessment found to the other.
  • Close the gap between your findings and theirs. Privacy and security each turn up risks the other needs to know about. Whatever the mechanism, a shared tracker, a recurring sync, a simple handoff, make sure neither team’s findings sit in a silo the other never sees. Also be sure the shared risk tracker has limited access so it’s not out in the open on the shared drive.
  • Agree on who says what before you need to. Decide now how a breach gets communicated and who owns which piece. There is SO much planning and coordination that needs to happen, and it’s imperative to have a plan, including who to call and what to say before there’s a real incident.   

Fraud is going to keep getting more convincing, and the law is going to keep adding to the requirements. When privacy and security teams talk with each other, share findings, and leverage tools to each other’s benefit, it saves time, money, and frustration.

And if you need help turning privacy into your security team’s strongest partner, hit reply and we’ll set up a time to chat.

Wishing you a great week!

Jodi

💡 When you’re ready, here’s how we can help:

⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.

⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.