Executive cybersecurity checklist

Why do attackers target executives?

Because one leader's account can approve payments, open data rooms and speak for the company. A hijacked inbox or a convincing fake of a CEO can trigger wire fraud, data leaks and public embarrassment, often without touching the corporate network at all.

Leaders are also easy to research. Their names, titles, travel and speaking slots are public, which helps an attacker write a believable message. This checklist covers the controls a non-technical leader can adopt with their IT or security team, in the order that matters most.

Which MFA should executives use?

Phishing-resistant MFA, on every account that matters. In a 2023 study of Azure Active Directory accounts, MFA reduced the risk of compromise by 99.22% across the accounts studied, and by 98.56% where credentials had already leaked.^[1]

Not all MFA is equal. CISA calls phishing-resistant MFA "the gold standard" and lists FIDO/WebAuthn and PKI-based methods in that group.^[2] It warns that codes sent by text or voice can be stolen through SS7 flaws and SIM swaps, and that push prompts can be abused by "push bombing".^[2] NIST is just as clear: one-time codes are not phishing-resistant, and its highest assurance level requires a phishing-resistant authenticator.^[3]

• Security keys or passkeys on email, the identity provider, banking, the domain registrar and cloud admin consoles.
• At least two registered keys per leader, one kept somewhere safe.
• SMS codes removed wherever a stronger option exists.
• A rule never to share or read out an MFA code to anyone.

Our guide to passkeys and WebAuthn explains how the rollout works.

How should passwords and logins work?

• A password manager for business and personal accounts, protected by a long passphrase and a security key.
• A unique password for every service; no reuse between personal and work accounts.
• Alerts on for new-device and new-location sign-ins, with an agreed response: change the password and tell IT.
• A quarterly review of apps connected to email, calendar and file storage, removing what is no longer used.

MFA does not stop every attack. Malware that steals browser sessions can bypass a login entirely, which our article on session hijacking and infostealers covers.

How do you secure devices and travel?

• Automatic updates on phones, laptops and tablets, and a short screen-lock timeout.
• Company devices enrolled in device management, so a lost phone can be wiped.
• No public USB charging and no unknown Wi-Fi without the company VPN.
• A separate travel device for high-risk trips, if your security team advises it.

For leaders at higher risk, Apple offers Lockdown Mode, which it describes as "designed for the very few individuals" who may be personally targeted by highly sophisticated digital threats.^[4] It blocks most message attachments, turns off links and link previews in Messages, and blocks FaceTime calls from people you have not called recently.^[4]

How do you shrink a public footprint?

Attackers build a profile of a leader from public sources before they strike. You cannot remove a leader from the internet, but you can remove the details that make an attack easy.

• Data brokers. Search people-search sites for each leader and use their opt-out forms. In California, residents can use the state's DROP platform to send one verifiable request that directs every registered data broker to delete their data; brokers must process requests at least once every 45 days from August 1, 2026.^[5]

• Public records. Check company filings, domain registration records and property records for home addresses and personal phone numbers, and use a business address where the rules allow it.

• Social profiles. Turn off location tags, post travel after the trip, and keep family accounts private. The FBI advises limiting online content of your image or voice and making accounts private, to make AI impersonation harder.^[6]

• Old accounts. Close unused forum, shopping and social accounts, and check whether leaders' personal emails appear in known breaches.

Repeat these checks every quarter, because records reappear.

How do you verify urgent requests?

With a second channel and a known number. If a request to move money, change bank details or share data arrives by email, chat, phone or video, confirm it by calling a number you already have. The FBI's advice for suspected AI voice calls is the same: hang up and call the person or organization directly.^[6]

• A code word agreed between leaders, assistants and finance.
• No exceptions for urgency, travel or seniority.

Our guide to executive impersonation covers the payment controls in more detail.

What goes in a personal incident plan?

One page, kept offline and on the phone:

• Contacts for the security lead, the bank's fraud line, the domain registrar and the mobile carrier.
• Steps to lock accounts, revoke sessions and change passwords.
• The specialist firm or counsel you would call for incident response or takedowns. That work belongs with firms the company contracts with, not with a marketing or brand partner.

How often should the checklist run?

Review it with your security team twice a year, and after any change in role, device or public profile. Run a short drill each time: spot a sample phishing message, revoke a connected app, and find the incident plan without help.

Our impersonation detection service covers the public checks behind this list as part of our digital asset security work.