By: Alvaro Corena, Chief Information Officer
It’s early in the day, and a member of the Finance team receives an unexpected WhatsApp video call from the company’s CEO. The CEO says that a confidential transaction is moving quickly and asks for an urgent payment to be authorized.
The request sounds plausible, and but something in the interaction feels off. Fortunately, the employee has been trained to watch for these types of AI-generated impersonations, and immediately logs into the company’s official channels to verify the request and flag the failed attack.
For companies whose staff are less equipped, this exact scenario has cost millions.
October is Cybersecurity Awareness Month, and as infrastructure consultants entrusted with the delivery of our clients’ most critical projects, our approach to cybersecurity goes well beyond awareness. We operate in a complex environment where cyber threats continue to increase in frequency, sophistication and scope. In this reality, cybersecurity is a business commitment to protect our clients, our company, and the execution of our projects worldwide.
Scope and Sophistication
The risk landscape has changed dramatically in recent years. For one thing, geopolitical tensions have expanded cyber conflict beyond ransom and financial motives, with nation-state actors and organized criminal groups targeting organizations that support critical infrastructure, government agencies, and large-scale projects. Sometimes financial gain is still the objective; but increasingly, we are seeing the disruption of critical infrastructure as the target.
Meanwhile, artificial intelligence has also dramatically altered cybercrime, enabling attackers to automate vulnerability identification, develop highly convincing phishing campaigns (including impersonating leaders), and execute attacks with speed and precision not possible before. Organizations like GISI Consulting Group are increasingly attractive targets and as we continue to expand globally and support high-profile programs across multiple sectors, our cyber risk profile naturally grows alongside our business.
Shared Responsibility
Cybersecurity cannot sit solely with the IT team. Every day, our people create, access, and share project documentation, engineering information, operational data, schedules, reports, and other material essential to client delivery. Each decision—how we handle information, respond to an unusual request, or report a potential threat—helps protect our clients, our colleagues, and the business.
That shared responsibility is fundamental to maintaining client trust and operational resilience. It helps keep sensitive information secure, enables teams to collaborate safely, and supports continuity when threats emerge. It also helps us meet contractual requirements, regulatory obligations, and client expectations in sectors where data protection and uninterrupted operations are critical.
Culture, Decision-Making and Operations
This is why we’ve worked so deliberately to embed cybersecurity into our culture, decision-making, and day-to-day operations at every level. Security awareness helps employees recognize and report suspicious activity, while established processes give them clear ways to verify unusual requests and escalate concerns. Across the Group, vulnerability management, access controls, incident response, and continuous improvement reinforce those individual actions with consistent organizational safeguards.
We also maintain internationally recognized security certifications and compliance programs, including ISO 27001, SOC 2, and CMMC. These programs independently validate controls spanning information security, risk management, access management, incident response, and continuous improvement, and help us meet the rigorous expectations of commercial and government clients.
Together, these measures give our people the knowledge, processes, and safeguards to make cybersecurity part of how we work, rather than a responsibility assigned to one function.
Investing for the Future
The threat landscape will continue to evolve as attackers adopt new technologies and methods. Across the Group, we continue investing in our cybersecurity capabilities: security awareness, vulnerability management, and automation to reduce security risk are priorities. These efforts are designed to continually reduce exposure, improve resilience, and ensure that cybersecurity remains aligned with the needs of our clients and the business.
By demonstrating competitively differentiated and automated information security practices aligned with our client risk concerns, we’re determined to maintain our reputation as a trusted advisor and dependable project delivery partner.