Commentary: Preparing for the future — SEC's focus on cybersecurity and 4 key recommendations for fund managers

The SEC is no stranger to providing clear guidance on fund managers' responsibilities for combating cybercrime and with a constantly evolving threat landscape, the regulator is taking renewed focus on the sector as artificial intelligence and other emerging technologies come into light.

Considering the SEC's statements and commentary over the past several years, a pattern has emerged in how the agency guides fund managers to take preemptive action in the preservation of their data. We've noticed four themes that fund managers should focus on to ensure their firm is not only in compliance with current guidance, but aligned to comply with possible future regulations.

1. Enhance existing cybersecurity programs — Investment managers should utilize advanced technology to implement protective measures that aren't just reactive, but predictive, proactive and constantly evolving. Technologies like anomaly detection based on machine learning and zero trust architectures are tremendously valuable in the development of a resilient program. In addition, it's essential to align policies with the ever-changing threat landscape and integrate real-time threat intelligence feeds.
   
2. Employ multifactor authentication — Relying solely on passwords is like using a wooden shield against modern missiles. To strengthen their domains, investment managers need to enable multifactor authentication. MFA involves combining passwords with a second set of credentials, ranging from one-time passcodes generated dynamically through secure mobile apps to more robust measures, such as scans or fingerprint recognition. When dealing with contractors or overseeing interactions with third parties, implementing MFA becomes even more important. Every interaction is an opportunity for a breach.
   
3. Conduct cybersecurity training for employees — In today's cyber ecosystem, fund managers must take the lead in fostering a culture of cyber resilience. From system administrators to brokers on the front lines and even executive decision-makers, cybersecurity must be a mindset, not just a set of protocols. Staff should recognize the signs of a cyberattack and know what steps to take in the event of a breach. By instilling an understanding of threats like spear phishing, where the adversary attempts to deceive its recipient to disclose sensitive information, or sophisticated malware campaigns, fund managers can work to make sure that every interaction — whether online, over the phone or via mobile devices — is conducted with a strong sense of awareness and preparedness.
   
4. Perform mock cybersecurity attacks — Fund managers can no longer rely on a defensive strategy. Customized training programs that incorporate real-world simulations of cyberattacks and AI-generated immersive scenarios can empower every employee to become a guardian of assets. Regularly conducting simulated cyber incidents is considered not just a best practice, but an essential foundation. By implementing tabletop exercises, managers can thoroughly evaluate the strength of their technological infrastructure and can refine communication protocols for informing teams and external stakeholders in real breach situations.

Moving forward, expect to see the SEC promote more hardening of cybersecurity policies for fund managers. While the above themes represent some relevant areas the agency is encouraging, there is anticipated level of maturation that the SEC will push fund managers to evolve to. Among the areas they are focused on are:

1. Moving beyond documentation: dynamic cyber policies — The SEC does not view cyber policies as documents that collect dust. The policies should embrace innovation, adapting along with advancements in generative AI tools. While these technologies offer insights and efficiency, they come with challenges, including potential misinformation or embedded biases. Therefore, policies should be flexible enough to evolve with changing technologies and align with objectives.
   
2. Developing an agile response mechanism — With the overarching goal of strengthening cybersecurity defenses, the SEC's guidance revolves around what can be called "muscle memory." The SEC aims for a coordinated and efficient approach, from identifying incidents to handling communications. This includes conducting regular assessments, maintaining an incident response team and training employees. Fund management should be prepared for taking immediate incident response actions.
   
3. The impact of AI: a revolution, with consequences —The appeal of AI is undeniable, as it presents efficiency and valuable insights. However, it is also a domain that comes with risks. Cyberattackers are utilizing AI to rapidly identify vulnerabilities in systems. Traditional defense mechanisms such as signature-based detections may not be sufficient to withstand AI-driven attacks. This highlights the importance of oversight, as with Europe's recent introduction of privacy regulations regarding AI.

Europe has already taken the lead by implementing privacy laws specifically focused on AI in June this year. The key lesson here is to harness AI's benefits while remaining cautious and vigilant.

The heightened focus on cybersecurity by the SEC emphasizes a new era in which fund managers must adopt both defensive and proactive measures. It is crucial for organizations to understand the cybersecurity implications of new technologies such as AI. The objective of the SEC is clear: to not only ensure fund managers comply with regulations, but to empower them as leaders in building digital resilience.

Ray Soriano is a director within EisnerAmper Digital. He is based in Miami, Fla. This content represents the views of the author. It was submitted and edited under Pensions & Investments guidelines but is not a product of P&I's editorial team.