SHRM26 Debrief · AI, Data & Tech · #1886
Secure HR: Essential Cyber and Data Protection Practices for Today’s Workplace
with Matthew Ritzman
"Approximately 74% of data breaches involve a human element."
What it was about
Cybersecurity is fundamentally a human/people problem, not just an IT problem, and HR is uniquely positioned to defend against it because HR controls access, policy, and culture — the three levers attackers actually exploit.
By the numbers
74%
Approximate percentage of data breaches that involve a human element.
$100 million
Estimated damage from the 2023 MGM Resorts ransomware attack.
99.5%
Speaker's estimate of how often a gift-card request from a 'colleague' is a scam.
Key notes
- Treat cybersecurity as an HR issue, not just an IT issue, because most breaches exploit human trust rather than technical vulnerabilities.
- Audit and promptly revoke system access when employees change roles, get promoted/demoted, or leave the company, since stale access is a recurring source of trade-secret and data exposure.
- Train HR staff and hiring managers to recognize deep fake tells (unnatural cadence, too-perfect delivery, fixed eye contact, lack of natural movement/jewelry, overly happy affect) in video/audio calls and interviews.
The contrarian takeTraditionally 'gold standard' evidence like a recording of someone's own voice or a video of them saying something can no longer be trusted at face value in HR investigations, because AI-generated fabricated recordings now can implicate someone in misconduct they never committed.
Take this back Monday
Do this for your team
Send a team-wide reminder on where to report suspicious gift-card requests or fake direct-deposit emails, and who to alert.
Say this in your next leadership meeting
74% of data breaches involve a human element, so cybersecurity is an HR problem as much as an IT one.
Watch out for
- Failing to revoke system/data access promptly after an employee is promoted, demoted, or leaves the organization.
- Assuming that seeing or hearing someone on video/audio is proof of their identity, given how convincing deep fakes have become.
- Treating recorded evidence (audio/video/text) in employee investigations as automatically authentic without checking metadata or provenance.
Fun fact · Matthew Ritzman
Before practicing employment law, he litigated for the NLRB and earned a Ph.D. in Educational Technology while working at the DOJ.
If this landed, see these
↳ Go deeperAI & HR: Enhancing Opportunities Responsibly in a New Era of WorkSame 'HR, not IT' argument, grounded in the actual state-by-state AI legal principles.⇄ The counterpointBeyond the Gut Feel: How AI-Powered Structured Interviews Are Transforming Hiring OutcomesPushes back with the opposite bet: AI-run structured interviews can build trust, not erode it.✦ The unexpected oneThe Chief Disruption Officer: Architecting Tomorrow’s Workforce EcosystemFits the same pattern: HR claiming ground IT and ops assumed was theirs alone.