Is Your Data Safe?

The doorbell rings. I look outside and see a little witch at the door. A ghost. And a miniature dinosaur.

“Trick or treat!”

How cute, I think, as I prepare to greet them, a bowl of candy in my hand.

Then I pause. Is it really safe to open the door? How do I know they’re not three zombies in disguise, ready to steal all the data off my laptop?

OK, I’m getting paranoid. Clearly, I’ve been watching too many cybersecurity training videos. But it’s not always easy to differentiate between what’s safe to trust and what could be a data breach in disguise.

And distinguishing between the two is only likely to become harder as advances in AI clear up a lot of the phishing clues we’ve been taught to spot, like grammatical errors, misspelled company names and oddly structured email addresses. Even more concerning is that information thieves can use AI to clone a manager’s voice providing clearance to release protected data or to create a convincing written message in the tone of that manager’s publicly available writing samples or social media posts, as Jeffrey Steele warns in this month’s feature on cybersecurity, “How Vulnerable Is Your Portfolio to Cyberthreats?”

AI is putting corporate data at risk in a lot of other ways, too—from exploiting employee carelessness to targeting outdated software—and commercial real estate companies are particularly vulnerable given the significant quantities of sensitive data stored and capital involved in transactions.

And it’s not just the big and better-known companies that are at risk. In fact, smaller and midsize firms have become more susceptible as the rate of cyberattacks increases, cybersecurity expert Daniel Dobrygowski noted in a recent Harvard Business Review article. Yet their security budgets are generally more limited, making it harder for them to combat the high costs of a breach.

That doesn’t mean they’re defenseless, however. Dobrygowski points to a variety of less costly ways to combat data risks, including some basic steps like taking greater advantage of underutilized aspects of existing software and cleaning up records and programs that are no longer needed. There are also some key questions worth asking vendors to ensure they’re taking appropriate steps to increase security, Steele notes.

Meanwhile, it’s important to remember that while AI has made it more challenging to guard against cyber risk, it’s not the only source of vulnerability. Ensuring data security requires a constant and varied vigilance.

So go ahead and open the door for trick-or-treaters. But make sure they can’t help themselves to sensitive information along with the candy.  

Read the November 2026 issue of CPE.