Why Inadequate Cybersecurity Is A ‘Guaranteed Money Drain’

This is the published version of Forbes’ CEO newsletter, which offers the latest news for today's and tomorrow's business leaders and decision makers. Click here to get it delivered to your inbox every Sunday.

---

Two of the biggest credit card companies are planning a merger that could change consumer spending in general and the credit card industry as a whole. Last week, Capital One confirmed the rumors of its planned acquisition of Discover Financial Services in a $35.3 billion deal. If the deal goes through, Capital One would be the largest credit card lender in the U.S., a boost from its current fourth-place ranking.

But the deal would also give a huge boost to Discover’s card network, which facilitates card transactions and sets fees that merchants pay for processing. Forbes’ Emily Mason writes this could mean new profit for Capital One. Currently, a federal law limits how much Visa and Mastercard can charge merchants. About 98% of Discover network transactions are not subject to the federal limit, and credit card issuers who don’t have to comply with it tend to make an average fee of 64 cents—nearly three times as much as the regulated ones. Capital One cofounder and CEO Richard Fairbank said on an investor call about the deal that this arrangement is what Capital One has always considered “the Holy Grail.”

However, this merger could reduce competition among credit card providers, which could bring higher fees and interest rates for cardholders. And as Americans are becoming more dependent on their credit cards, it could compound into a terrible deal for consumers. According to a report released earlier this month by the Federal Reserve Bank of New York, credit card debt is steeply increasing. As of the end of 2023, Americans have nearly $1.13 trillion in credit card debt, a number that increased by $50 billion in just the last quarter, and is up $143 billion year-over-year. Credit card debt is reaching serious delinquency, defined as payments 90 days or more overdue, at a faster rate than any other kind of debt, with nearly 6.4% reaching this status in the last three months of 2023. New York Fed Economic Research Adviser Wilbert van der Klaauw said in a press release that delinquency rates are still rising above pre-pandemic levels.

The big question now is whether the deal will go through. Under President Joe Biden, the Justice Department has successfully blocked several mergers. Most recently, JetBlue’s planned takeover of Spirit Airlines was halted, with a judge ruling it would have increased prices for consumers and eliminated discount flight options. Reuters reported investors think there’s only a 50% chance the Capital One-Discover deal will go through, and that hinges on Capital One having to show benefits to consumers. Few proposed mergers would directly impact so many consumers at once; the large amount of credit card use and debt among Americans shows that this deal could quickly change the consumer economy on the whole.

While personal spending and budgeting is important to consumers, business executives also have deep concerns about where they are using their funds. While cybersecurity initiatives are not necessarily seen by most consumers, Kiteworks Vice President of Corporate Marketing and Research Patrick Spencer and CMO Tim Freestone say it should be every business’s top IT priority. I talked to them about budgeting for cybersecurity, and a portion of our interview is later in this newsletter.

FUNDING + FINANCES

As Carson Group strategist Ryan Detrick said in an email to Forbes, “Few things are more certain than death, taxes, and Nvidia beats on earnings.” On Wednesday, the AI chips titan shattered expectations and broke records for the third consecutive quarter, boosting itself and the markets as a whole into new territory. After Nvidia’s blockbuster earnings report, the company’s market cap swelled past $2 trillion for the first time, solidifying its status as the world’s third most valuable company. And its stock performance helped the S&P 500 and Dow Jones Industrial Average both hit record highs on Thursday. Cofounder and CEO Jensen Huang, who owns about 3.5% of Nvidia’s shares, also benefited. His wealth swelled by about $9.5 billion after the earnings report.

Nvidia’s quarterly revenue was $22.1 billion, a 265% year-over-year jump. Data center revenue was $18.4 billion, up 409% from a year ago. And its full-year revenue was $60.9 billion, up 126% from 2022. “Accelerated computing and generative AI have hit the tipping point. Demand is surging worldwide across companies, industries and nations,” Huang said in the earnings release.

BIG MOVES

The fight over ownership of Macy’s is turning into a proxy battle. After the department store chain rejected a $5.8 billion takeover bid from investors Arkhouse Management and Brigade Capital Management in January, Arkhouse fired back by nominating nine people to serve on Macy’s 14-member board of directors, reports Forbes senior contributor Walter Loeb. With that kind of a majority, there’s no question that Arkhouse will succeed in its quest to take ownership of the publicly traded chain and take it private. According to Macy’s, the retailer’s current board and its advisors were concerned about Arkhouse’s ability to execute the financials of the deal. The information Arkhouse submitted did not allay those concerns, so Macy’s determined the proposal was not actionable. There is no date set for Macy’s annual meeting, during which it will vote on those board nominations, but the company is slated to report its next set of earnings this week. The situation certainly adds another layer of difficulty to Macy’s new CEO Tony Spring, who just took the helm this month.

ECONOMIC INDICATORS

In 2023, the U.S. gaming industry hit the jackpot. Total revenue from slot machines, table games, sports betting and mobile casino games hit a record $66.5 billion last year, a 10% increase over 2022’s record, according to the American Gaming Association. Numbers are climbing across the board: More states have recently legalized more forms of gambling, more people are going to casinos (41% of U.S. adults entered one last year) and the average age of visitors has dropped to 42, down from 50 in 2019. Sports gambling is the biggest growth engine, however, AGA Vice President of Research David Forman told Forbes’ Will Yakowicz. Sports betting, now legal in 38 states after widespread expansions in the last six years, has helped boost gaming revenue 50% since before the pandemic, Forman said.

COMINGS + GOINGS

A month and a half after a door plug on an Alaska Airlines jet blew open in mid-flight, the head of the Boeing program that makes that jet is leaving the company. An email employees received last week said Ed Clark, the leader of the 737 Max program since 2021, was leaving the company immediately. He had worked in different positions at Boeing since 2006, and he was responsible for running the Renton, Washington campus where the airplane manufacturer has made 737s for more than a half century. He was replaced by Katie Ringgold, who was promoted from vice president of 737 delivery operations.

Since the incident, Boeing CEO Dave Calhoun has been saying that the company takes responsibility for what happened. Clark is the first high-level employee to have lost his job in connection with the incident. The National Transportation Safety Bureau has been investigating what led to the issue, finding loose hardware on some planes and general quality control issues at manufacturing facilities. Clark likely did not have any direct role in the manufacturing issues. Forbes’ Jeremy Bogaisky spoke to aerospace experts, as well as current and former Boeing employees, who indicated one of the manufacturer’s biggest problems could be the large number of new employees hired after the pandemic. It takes time and training to master the tasks to safely build an airplane, and many people said employees likely did not get the quality of training necessary for their jobs.

TOMORROW’S TRENDS

Kiteworks’ Patrick Spencer And Tim Freestone On Why Protecting Data Is A Top Priority

Just about every modern business has a lot of data it literally cannot afford to have compromised in a cybersecurity attack. I talked with two Kiteworks leaders, Vice President of Corporate Marketing Research Patrick Spencer and CMO Tim Freestone, about how executives need to approach cybersecurity priorities today. This conversation has been edited for length, clarity and continuity.

When the C-Suite is looking at tech goals, especially this year, where does improving cybersecurity sit? What priority should it have?

Freestone: If you’d asked me that question 10 years ago, I probably would have said it should be number one, but it’s probably number 10. It should be number one, and from everything we're seeing in the market, it’s becoming number one. The reason is money. Every decision a CEO makes is about two things, usually. One is how do I keep the board off of my back, and then two is how do I make the most money for the company? Usually those two things go hand in hand. An inadequate cybersecurity posture is [a] guaranteed money drain at this point. You’ve got legal fees that CEOs have to worry about, even with the slightest breach. You’ve got compliance regulation fines. You’ve got brand reputation and market that impacts revenue. And in some cases of cybersecurity incidents, you’re losing money in terms of ransomware. It’s an absolute sieve of money right now, and any CEO that isn’t prioritizing this in the top one or two spot is probably going to have trouble in the next few years.

Spencer: There’s a long tail effect which you probably hear about on these breaches. There’s the immediate impact, but then there’s all the lawsuits and fines and penalties and bad news in the press that will carry out for four years or longer, and there’s legal fees associated with it. It just becomes a big headache; it doesn’t ever go away. It just hangs around forever. And I think there’s a growing realization that that's a bigger problem than most people realize.

When talking about tech priorities, especially for this year, many people are the most interested in AI. How do you convince the decision-makers that cybersecurity is a bigger priority?

Freestone: One thing about security is you don’t need to abstract it from the decision of other business priorities. You just incorporate it as part of the process. A business might say, look, from an IT standpoint, our priority is AI because that’s going to increase productivity, which increases bottom line. But it’s not. Secure AI is our priority. Simply shoehorning the concept of everything that is going to be done technically, from a business priority standpoint, with secure by design into it, is what the decision-making process should be. It’s not an either-or. It’s a with.

Companies are under enormous pressure to cut costs right now. How can you convince the decision-makers that you can cut costs, but need a cybersecurity investment?

Freestone: The answer just comes down to what’s our risk threshold? How much do we anticipate the cost of a breach, versus the cost of pencils across our company? That’s a fixed cost. We’re going to spend this much money on stationery and pencils across all of our remote offices across the globe. A breach is a huge cost. Compliance fines are major costs, and they don’t happen until they happen. So what’s the company’s risk threshold for those costs, versus the cost of securing to prevent those costs?

Most companies have very sensitive data: Customer data, medical records, PII, the company’s own IP. What kind of steps need to be taken now to keep all of that more protected?

Freestone: People need to internalize that data is the point. …Nine times out of 10, data is the point of all breaches. If companies realize that data is the point, then they need to start focusing on the data layer and the security around the data. Historically, companies have been focused on securing technology that has access to the data. So securing the network, securing applications, securing the devices. Any CEO, CIO, CXO, whatever the case may be, has a plethora of options to secure those technologies that sit in front of the data. …In the last five or 10 years, the focus has shifted to specifically the data. You start seeing technologies like the revival of digital rights management, [and] taking away some of the challenges that digital rights management faced 10 years ago. …There are things like privacy-enhancing technology, new encryption. It’s all now focused on the data layer.

Are companies getting to the point at which they are focused on data?

Freestone: For sure, but we’re seeing regulators drive action because there’s more and more regulations. [Fourteen] states have regulations around securing the data and protecting data privacy. There’s more and more global regulations. So companies are actually being forced to pay attention to the data layer more than they ever have before. …The task at hand to bring security to the data layer—we’re talking petabytes of information—classified to scale, to track, to control, historically has been sort of ignored because it’s too difficult. As cybersecurity technology has evolved over the last five to 10 years, it's becoming more and more reasonable to be effective at that layer. And so between compliance regulations and technology stacks that are focused on the challenges of classification, scaling, and tracking and controlling data, we’re seeing more of it now.

Spencer: Regulators, certain ones, are becoming more active in terms of issuing fines and penalties. …Fines for [the EU’s General Data Protection Regulation] were higher [in 2023] than 2019, ‘20 and ‘21 combined. They are issuing more fines and penalties. And you have to release [information] if you’re breached within a certain time frame. All these different components of the regulations are driving better behaviors at the end of the day.

FACTS + COMMENTS

Social media company Reddit officially filed for its long-awaited IPO with the Securities and Exchange Commission last Thursday. The company would trade under the ticker symbol RDDT.

$804 million: Reddit’s revenue last year

73 million: Average daily active and unique users on the platform

‘Advance our mission, become a stronger company, and provide meaningful benefits to our community’: Reddit’s explanation for going public in its prospectus

STRATEGIES + ADVICE

If you need inspiration, it’s OK to look further outside of your comfort zone. Four in 10 companies look outside their industries for ideas.

It’s difficult to balance a career and child care. Here are four ways your company can work with employees with small kids.

Having a good relationship with your investors pays off. Here are five tips to work with them.

QUIZ

Dolly Parton recently brought her ode to working women, “9 to 5,” into a new song, collaborating with another recording artist. Who is it?

A. Beyoncé

B. Pitbull

C. Lil Nas X

D. Lizzo

See if you got the answer right here.