---
title: "Ghost Incidents and the Panel That Couldn’t Agree on Failure"
description: "Yesterday I sat on a Bolster AI panel about brand impersonation and AI-enabled fraud alongside Rod Schultz, Bolster's CEO, and Hamza Zaman, head of information security at Numerix. Attackers have worked out that hacking a company is optional when impersonating"
url: https://kaynemcgladrey.com/blog/ghost-incidents-and-the-panel-that-couldnt-agree-on-failure/
date: 2026-10-30
modified: 2026-10-30
author: "Kayne"
image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/Ghost-Incidents-and-the-Panel.webp
categories: ["Blog"]
type: post
lang: en-US
---

# Ghost Incidents and the Panel That Couldn’t Agree on Failure

Yesterday I sat on a [Bolster AI panel](https://events.zoom.us/ev/AmAc5Q35FcQd3n11QCcuDLXYlw7hZ1PRwIlA0qRJHtac2tO103Iw~AiXkcKJPZuh9EpDz0WVelyTCfWayNgl1LWv6tbFGdXRwpZUuV6gExiM5SQMhSbPMBrfrECX7r2RQ1bDigKppzhGdUQ) about brand impersonation and AI-enabled fraud alongside Rod Schultz, Bolster’s CEO, and Hamza Zaman, head of information security at [Numerix](https://www.numerix.com/). Attackers have worked out that hacking a company is optional when impersonating it pays just as well, and the targets are your customers, your executives, and your brand, all reached through channels your firewall never inspects.

We agreed on more than I expected going in. The one real fight was worth having.

## The Firewall Was Never the Boundary

Rod opened with the perimeter question and Hamza dispatched it in a sentence. Calling the firewall the right boundary is a 2015 question, not a 2026 question. At Numerix, he said, the identity provider has become the front line, and the attacks that drain real money stroll past edge appliances without ever touching them.

I went further. The firewall was never the right boundary, it was theater visited on us by vendors who had firewalls to sell, and decades of perimeter thinking did lasting damage to how organizations reason about risk. A firewall won’t save your accounting controls, and business email compromise passes or fails based on them. About 135 people attended the panel, and roughly two-thirds of them agreed the firewall isn’t the right boundary, which tells you how far the consensus has traveled.

### The Controls That Cost Nothing

The cheapest idea of the hour was also the most useful. Hamza called his own position contrarian when he said the highest impact controls are almost always free, and I’d been making that argument from the accounting side for years. Pick up the phone at the number already saved in your contacts. Walk down the hall. Confirm on Signal before authorizing a wire transfer. Second-channel verification is a control your grandparents’ bank understood, and it costs nothing to deploy.

## Did the Security Program Fail?

Midway through, Rod asked the question that split us.

*If a customer falls for a perfect fake of your company, did your security program fail?*

Hamza said yes, immediately, and argued that this class of incident is nastier than a breach. He calls it a ghost incident, and he may be right that it’s the worst kind to have. The attack succeeded in your customer’s inbox, on a spoofed domain, over a voice that sounded like your CEO, and you learn about it when the money is gone and the victim calls your support line.

> A ghost incident leaves you with no logs, no artifacts, no playbook, because nothing touched your infrastructure.

I said no. I’m not an attorney and this is opinion rather than legal advice, but consider what there actually is to investigate. There’s no unauthorized access, no data loss to disclose, no fine to negotiate, and in practice no derivative suit landing in the [Delaware Court of Chancery](https://courts.delaware.gov/chancery/) if the board was briefed on the risk possibly existing. Unpleasant, certainly. A defined failure, no.

Hamza and I worked out why we were talking past each other. He described operational failure, I described legal and financial consequence, and both are defensible readings of a failed security program. They just aren’t the same reading, which is why the audience vote on this started nearly even before drifting toward no.

### The Fake Press Release Problem

One variant deserves its own warning. A fake press release on a publicly traded company that doesn’t get caught can move the share price before anyone in communications knows it exists. That’s a market event wearing your logo, and the disclosure clock starts whether you’re ready or not. Nobody on the panel had a clean answer for who owns it.

## Who Owns Impersonation Risk?

The sharpest number of the day came from the audience. Asked who owns the risk when customers are targeted by fakes of your brand, 134 attendees answered like this.

| Answer | Votes | Share |
| --- | --- | --- |
| Security | 51 | 38% |
| No one clearly owns it | 37 | 28% |
| Legal | 16 | 12% |
| Fraud | 14 | 10% |
| Marketing or brand | 11 | 8% |

Shares don’t total 100 percent because a sixth option (which was a typo) drew the remaining votes.

Security took the plurality at 38 percent, but the result that surprised me is that 28 percent of practitioners looked at their own org chart and picked “nobody”. Roughly 70 percent of the same audience said the CISO mandate is already too narrow, so they know who’s about to inherit this problem regardless.

My position was straightforward, and if you’ve read my book, you’ll see why. CISOs shouldn’t absorb unowned risk just because the job title seems to imply responsibility for all of it. That’s how careers end. If I don’t have budgetary or management authority over something, I can’t apply controls to it, and pretending otherwise is a compliance fairy tale. The three lines of defense exist so the second line advises without absorbing. Put a RACI chart, the responsible-accountable-consulted-informed grid, in front of the business owners and make them agree who’s on first, in writing.

Hamza’s counterweight was the risk register. If executive identity is an asset, and it plainly is, it belongs on the register with everything else, tracked and reviewed. He’s candid that legacy risk registers linger in the background even after a unified one exists, and as he put it, if no one else steps up and you’re owning everything, the governance is broken. We converged on the practical division of labor. The CISO owns the incident, coordinates the response, and drives remediation. The business owns the risk.

## What the Audience Got Wrong

Asked where they’d put their next dollar, 131 attendees chose awareness training first.

| Answer | Votes | Share |
| --- | --- | --- |
| Awareness training | 58 | 44% |
| Helping customers and employees verify what’s real | 50 | 38% |
| Finding and removing fakes | 23 | 18% |

They picked training while listening to a panel explain why training alone doesn’t work. Training belongs in the mix. Ranking it first is the mistake. Research presented at [Black Hat 2025](https://www.blackhat.com/) found the math on phishing training doesn’t hold up, and much of it survives because insurers expect it as a control. Rod’s hot take was sharper than mine. “We can patch binaries, we can’t patch people.” He’d still fund the training anyway, and Hamza defended continued investment on the grounds that rotating providers helps and the secondary verification protocol is what saves you. All three of us arrived at the same practical conclusion. Train people, and verify separately before money moves.

The fear rankings told a similar story. Deepfake voice or video topped the list at 42 percent of 132 votes, while fake social accounts and ads drew 7 percent. Rod spends his days watching spoofed profiles and fraudulent ads feed the lookalike domains and fake support numbers downstream, the whole supply chain of deception. The audience fears the Hollywood stunt hacking attack, and shrugs at the plumbing that builds it.

## Four Moves Before 2027 Budgets

- Run a tabletop where the injection is a deepfake of your own CEO. Hamza’s suggestion, and he’s right that showing losses beats explaining threats. It costs nothing, it’s memorable, and it exposes gaps like who picks up when marketing spots a spoofed domain before security does.
- Treat provider impersonation as your problem if you’re in scope for Europe’s [Digital Operational Resilience Act](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/digital-operational-resilience-regulation_en), or DORA. Hamza expects clients to come knocking when a vendor gets spoofed, and regulators wrote that expectation down.
- Ask your broker, in writing, at renewal whether paneled incident response covers impersonation attacks. Assume carve-outs until proven otherwise. Insurance companies aren’t charities, and the actuarial math on this barely exists.
- Fix the boring foundations first. Patching, authentication, segmentation, attack surface hygiene. Get that locked in and you’re ahead of most of the market.

## Agentic Banking and the Attribution Problem

The forward-looking risk that got the least airtime is the one that worries me most. Frontier labs won’t train agents to defeat bank-grade defenses, but undercapitalized startups building agentic banking will ship whatever closes the funding round, and consumers will hand those agents their passkeys and bank account details without reading the terms of service or privacy policy. When the money disappears, good luck proving the agent did it rather than someone in Pyongyang who grabbed the credentials.

## The Definition Fight Continues

Strip away the poll numbers and the AI framing, and the argument was about vocabulary. What counts as failure, and who owns risk that lives outside your walls. Those are definitional disputes rather than factual ones, and the industry hasn’t settled either.

These questions get more expensive to answer every year. The 28 percent who admitted nobody owns this risk are the reason why.