Cybersecurity in the age of AI

The cybersecurity threat landscape shifts constantly, and AI has made phishing more convincing, deepfakes more believable and attacks easier to scale. As a plan sponsor, you’re not expected to know everything about cybersecurity, but you are expected to have a prudent process for making sure the partners entrusted with your participants’ data and retirement assets are doing enough.

What follows is a practical framework including the questions worth asking and what to look out for in the response.

The questions to ask your service provider

1. How does the provider monitor for unusual participant account activity?
2. What processes are used to identify, investigate and respond to potential fraud?
3. How frequently are cybersecurity controls and policies evaluated or independently assessed?
4. Does an Incident Response plan exist in the event a data breach occurs?
5. How are employees and participants educated about phishing and AI-enabled social engineering tactics?
6. How does the provider assess third parties that handle plan or participant information?
7. How are technology, governance and human oversight combined when responding to risk?
8. What protections or guarantees may apply if an eligible participant account is compromised?

These questions are designed to reveal whether a provider has built a genuine culture of cybersecurity preparedness or is relying primarily on technology as a talking point.

What does a strong answer look like?

A provider with a genuinely strong cybersecurity program will show:

• Technology, people and processes working together. AI and machine learning used to surface potential risk, with trained teams and defined processes governing how that risk is evaluated and addressed instead of automation acting on its own.
• Fundamentals treated as foundational, not outdated. Strong password practices, access controls, employee training and governance maintained alongside advanced detection, because many successful attacks still exploit these longstanding weaknesses.
• Ongoing, independent validation. Controls assessed on a regular cadence, including by outside parties instead of just internal monitoring.
• Education as a continuous practice. Training for employees and participants, refreshed regularly and updated to reflect evolving threats like AI-enabled phishing and deepfake social engineering.
• Recovery is timely and security is a priority. To ensure legal and regulatory compliance, ensure a process is in place to handle a breach, provide communication and safely backup and restore systems that house important and sensitive data and information.
• Clarity on recourse. A direct, specific answer about what protections apply if an eligible participant account is compromised.

Artificial intelligence is changing cybersecurity, but technology alone is not the answer. For plan sponsors, preparedness begins with understanding how providers approach cybersecurity, how they adapt to emerging threats, and how they combine innovation with proven security practices. The organizations positioned for the future will be those that pair advanced capabilities with disciplined governance, strong controls and a sustained commitment to protecting participant information and retirement assets. That combination of technology, people and process remains one of the strongest foundations for resilience in an increasingly complex digital environment.