In an age marked by accelerated technological evolution, the advent of generative AI (GenAI) offers businesses transformative potential. For CFOs, navigating GenAI entails more than just recognizing its potential; it requires a comprehensive understanding of the associated financial risks. Time’s recent designation of "ungoverned AI" among the top risks of 2024 underscores the imperative for proactive engagement. Indeed, business have already experienced risks to data privacy, legal obligations and intellectual property, driving the need for organizations to take measures to mitigate the data risk while harnessing the power of GenAI. 

As stewards of financial risk and strategy, CFOs must heed this call with keen discernment. This responsibility is particularly crucial given the Securities and Exchange Commission's heightened emphasis on cybersecurity regulations, which elevate the personal liability risks faced by corporate leaders, including finance chiefs. Likewise, the introduction of newer EU cyber laws, such as NIS2 and the newest executive order issued by President Biden further accentuates the obligations and personal liabilities faced by management bodies, including company boards and executives. 

Central to the discernment of CFOs is the imperative to delve into financial risk modeling, examining the critical intersection of AI and sensitive data.  

Assessing financial risk exposure 

Understanding the financial risk associated with sensitive data demands strategic collaboration and meticulous evaluation. CFOs must engage stakeholders and adopt effective strategies to identify and assess the value of data across the organization’s ecosystem.  

Among the array of available approaches, two methods stand out: data discovery and data sampling. Each offers a unique perspective on the distribution and significance of sensitive organizational data. 

• Data discovery: Not all data is created equal — and not all sensitive data represents the same exposure risk to an organization. Data discovery evaluates data within the organization to identify what is sensitive such as financial information, personally identifiable information (PII), trade secrets and intellectual property. By highlighting sensitive data, CFOs can help teams prioritize data protection measures for risky applications and locations where data is stored. 

• Data sampling: In scenarios where analyzing every data point is impractical, intelligent sampling techniques offer a pragmatic solution for identifying high saturation areas containing sensitive data. Intelligent data sampling techniques efficiently identify and prioritize risks by focusing on key "hotspots," analyzing only a fraction of the data while considering their potential impact and sensitivity levels. 

Sophisticated risk modeling 

Many factors are at play when calculating the financial risk of the organization’s sensitive data, such as expenses related to data loss, detection, escalation, post-breach response, notification and the cost of lost business. While risk modeling aids in assessing the riskiness of data, relying solely on a flat cost per record may oversimplify the analysis. Research indicates that linear representations based on value per lost record often underestimate small breach costs and overestimate large ones.  

For example, the Cytenia Institute Information Risk Insights Study introduces a model using a log-normal scale for more accurate financial loss representation and breach probability analysis. According to historical data, the Cytenia study finds that the average breach cost is approximately US$200,000, with 10 percent of breaches classified as extreme, exceeding US$20 million. On the higher end, Fortune 250 organizations face a financial exposure risk of US$100 million or more.  

Such disparities underscore the importance of employing a more sophisticated approach to risk assessment for more precise assessment of potential financial losses. 

Building financial resilience 

Inevitably, the key in minimizing the financial risk lies in preparedness and resilience. Proper discovery and protection techniques serve as formidable bulwarks against the disruptive aftermath of breaches, slashing associated costs by a staggering 64 percent or more for each event. As CFOs chart their course to navigate the organization’s usage of gen AI, these insights serve as guiding principles for prudent risk management and sustainable financial resilience. 

The transformative potential of gen AI beckons CFOs to embrace a paradigm shift in risk assessment and mitigation. By delving beyond surface-level evaluations and harnessing advanced tools and techniques, CFOs can navigate the complex terrain of data security with confidence.  

As breaches loom as an ever-present threat, proactive measures and strategic investments in protection pave the way for financial stability in an uncertain landscape. Thus, equipped with knowledge and foresight, CFOs stand poised to mitigate regulatory risks to both their corporate and personal liabilities while guiding their organizations toward a future defined by resilience and prosperity in the age of GenAI.