AI for Security and Business
Wednesday 7 October — Art of Trade · Security & business — the peak-season week
The table
Executive summary
Moderator introduction
Imagine you are the CEO of a family-owned food company during the most important week of the year.
For six weeks, an attacker has quietly been inside your company.
It began with a convincing supplier email. One employee logged into a fake portal, unknowingly giving the attacker access to financial information, contracts, and internal systems.
Nobody noticed.
The attacker learned how the company worked, who trusted whom, and where the pressure points were.
Then AI made the attack even more powerful.
The CEO received a phone call that sounded exactly like her father, the company’s founder. She was instructed to approve an urgent supplier payment to a new bank account.
The email looked legitimate. The documents looked legitimate. Even the company’s own AI assistant summarised the change as confirmed.
She approved the payment.
It was fraud.
Days later, production stopped, systems went down, and ransomware followed.
Now the CEO has only hours to decide how to protect the company when email, documents, and even familiar voices can no longer be trusted.
Questions for the table
- What does trust mean in a world where AI can reproduce people, messages, and information?
- Would you pay the ransom?
- How should organisations communicate during an AI-enabled cyber crisis?
- How do we design organisations where people and AI know when to trust each other—and when not to?
The case
Subtitle: In the biggest week of the year, the CEO of a family fruit company learns that the voice she trusted, the assistant she paid for and the numbers she kept private already belong to someone else.
Six weeks of good emails
Zorić Plodovi packed and processed mandarins in Opuzen, in the Neretva valley. Two hundred and sixty people in November, half of them seasonal. Fresh mandarins for Germany, Austria and Poland, from mid-October to early December, were sixty per cent of the year; juice, jam and candied peel carried the other months. Ante Zorić had built the company over thirty years. His daughter Marija, forty-one, had been CEO for eighteen months. Her father still signed the biggest contracts and still called the jar supplier in Italy "Bepo", because they had been drinking together since 1998.
The first email arrived on 29 September. It came from Bepo's export manager, whose name and style Tomo in accounts payable knew well. It referred to the right purchase order, the right pallet count and a delay at the port of Trieste that was real. It asked for nothing. The second one, a week later, asked Tomo to confirm a delivery date on the supplier's new portal. The portal was a copy of the company's own sign-in page, sitting between Tomo and Microsoft. He typed his password and the two-digit number his phone showed him, and his session went to someone else.
From that morning someone else read Tomo's mailbox, and through it the shared finance drive. The 2026 budget. The margin per pallet for each retail chain. The cyber insurance policy, limit five hundred thousand euro. The loan agreement with the bank and its covenant. The contract with the German discount chain, including the penalty per missed delivery slot. And a spreadsheet kept for the auditors, with the external IT firm's remote-management login — the tool that pushed updates to every machine in the plant. Nobody noticed. Nothing was encrypted and nothing was stolen in a way that made a noise. Six weeks of the export manager's emails had cost whoever wrote them a few hundred euros in model calls.
The company's own mail assistant, which Ivana in finance had bought in the spring to summarise long threads, kept summarising. The later emails from the export manager carried a few lines of white text that no human saw. The assistant saw them. In its summaries the supplier's bank change appeared as: "Bank details updated; confirmed in the attached signed letter; no action needed."
Thursday, 15:40
On Thursday 12 November Marija was in the cold store with the production manager, counting pallets for the Monday loads. Her phone rang. Her father. His number, his voice, the wind of the boat behind him. Twenty minutes of him on the radio about last year's harvest had been enough. He was off Korčula, the signal was bad, he had a minute. Bepo had merged the firm with his son-in-law's company, the bank account had changed, Ivana had the letter, and the jar payment had to go today or the Christmas jars would go to a Polish buyer instead. "Don't call Bepo about it, he's touchy about the son-in-law. Just sign it, Mare. I'm back Sunday."
He hung up. She called back. Voicemail. She checked: he was on the boat, he had posted a photo of the sunrise that morning.
Ivana had the email and the letter, on the supplier's letterhead, signed. The assistant's summary said no action was needed. The payment run closed at 16:00. Four hundred and twelve thousand euro for glass jars, the last delivery before the peak. Marija had spent eighteen months proving to the old management that she did not need to call her father before every decision. She signed at 15:52.
The bank's payee check came back "close match": a UAB in Vilnius carrying the supplier's name and one extra word. The merger letter explained the extra word. The bank's fraud model held the payment for twenty minutes; the relationship manager, who had known Ante for twenty years, released it on Marija's word at 16:14. Two machines had flagged it. Two people had waved it through. By Friday morning the money had left Vilnius.
Monday: the real Bepo
On Monday 16 November at 09:10 Bepo himself called Ante, who was back from the sea, sunburnt and in a good mood. Where was the money? The trucks with the jars were loaded and would not leave Italy. Ante walked into Marija's office with the phone still in his hand. She told him about Thursday's call. He had not made it. He had been fishing, with the phone in a drawer.
The bank tried a recall. The receiving bank replied on Tuesday that the account had been emptied within an hour. Dario, the one IT person, with the external firm on the line, found the forwarding rule in Tomo's mailbox, the sign-in from a device in another country, and six weeks of file-access entries in the audit log, on documents Marija did not know were on a shared drive. The IT firm's monitoring had ticketed that sign-in on 7 October as "user travelling" and closed it. Ivana filed the police report at 15:00; the bank's recall and the insurer's claim both wanted the number. At 17:30 they reset every password in the company and ordered hardware keys for finance.
Whoever was inside saw the reset. At 02:10 on Tuesday 17 November, pushed through the IT firm's own update tool, the ERP stopped. Then the warehouse system. Then the labelling lines, the cold store telemetry, the invoicing, the transport planning. A text file sat on every screen. It was in good Croatian. It gave a link and a deadline: forty-eight hours.
That week thirty-eight trucks were scheduled. The German chain's delivery slots opened on Thursday at 06:00. A missed slot cost twelve thousand euro and a delisting review. Eleven hundred tonnes of mandarins stood in the yard, picked; they would keep nine days. Cash at bank: three hundred and ten thousand. Unused overdraft: two hundred thousand. Payroll for two hundred and sixty people, three hundred and ninety thousand, on the 25th. Bepo still wanted his four hundred and twelve thousand, again, before one truck of jars left Italy. Two hundred and sixty people arrived at 06:00 on Tuesday and found the lines dark. By 08:00 all of Opuzen knew the lines were dark; someone's cousin worked at the bank, and the relationship manager called Marija before she could call him.
The other side knew the numbers
Marija opened the link at 07:15 from Dario's laptop, with Ivana beside her and her father in the doorway. "We changed the locks and left the windows open," Dario said. Nobody had revoked the sessions. A chat window. She typed that she was the CEO and asked what they wanted. The reply came in four seconds.
It addressed her by name. The demand was one million two hundred thousand euro in a cryptocurrency, within forty-eight hours, after which the price doubled and the German contract, the budget and the payroll file would be published. Then it helped her think. Her penalties for missed slots this week, it wrote, would be at least six hundred and ten thousand. Thursday's transfer, it wrote, fell under her policy's social-engineering sub-limit of one hundred thousand, and the callback the policy required had never been made; the ransomware was covered up to five hundred thousand less the deductible, after the insurer's negotiator, the insurer's consent and a sanctions check on the wallet. Her bank covenant would break if fourth-quarter revenue fell twelve per cent. It offered a discount for speed: eight hundred and fifty thousand if she paid by midnight. It answered at 03:00 and at noon in the same tone.
By 09:30 the insurer's breach coach was on the line: do not pay, do not answer them except through our negotiator, sanctions check on the wallet before any payment, forensics remote from noon and on site Thursday — and a letter reserving the insurer's position on Thursday's transfer, because the callback had never been made. The bank, where the relationship manager had known Ante for twenty years and had released Thursday's payment on Marija's voice, wanted a statement by Wednesday, an answer on whether the loan was still safe, and from now on nothing from Zorić Plodovi by phone or email: after Thursday he could no longer trust a voice from Opuzen. Recall, covenant, any purchase of crypto — in person, with identity documents. There was no path to eight hundred and fifty thousand in crypto for a d.o.o. in thirty-six hours except the insurer's negotiator — which meant the insurer's consent, which meant the reservation-of-rights letter first.
Sales had the German buyer on the line asking whether Thursday was confirmed. Dario said restoring from backups would take four to six days if the backups were clean, and one of the three was not. The production manager said the mandarins could go loose to a buyer in Bosnia at a third of the price, if the trucks left tomorrow. Ivana had two more clocks on the whiteboard beside the attacker's: early warning to the national CSIRT by 02:10 Wednesday; the personal-data notice — the payroll file — by 02:10 Friday.
The one thing that had not gone dark was the delivery record on the NEO stack, which the German chain had made a condition of the contract in the spring. It showed which loads had been authorised and which had actually left the yard, and Munich's system had been reading it all night: the buyer knew which Thursday loads were real before Marija did.
At 11:40 her father asked her, quietly, in front of Ivana, whether she had really believed he would call her about a bank account from a boat. She did not answer. The whole day shift was in the canteen, waiting for someone to tell them whether to go home.
She had told the canteen she would speak at 12:00. Before that she had to decide: whether to pay, and with whose money; whether to tell the German buyer the truth or ask for two days; which of the three clocks on the whiteboard to serve first — the CSIRT, the insurer, the data authority; whether to send the fruit to Bosnia at a loss; and what to say to her father, to Bepo, to two hundred and sixty people at 12:00 — and through which channel, now that her mailbox and her father's voice were not hers.
At 11:52 sales stood in the doorway. "Munich wants Thursday yes or no by noon. Not maybe."
At 11:58 the window blinked: "Marija, you have thirty-eight hours. I can also offer a payment plan."
Discussion Questions
- Pay or not — and with whose money? The insurer's negotiator, the overdraft, the father, the buyer: which of those calls can Marija still make herself by noon?
- Munich wants yes or no by noon. The truth, or two days? What does each answer cost on Thursday, and what does it cost in March?
- Eleven hundred tonnes will keep nine days. Does the fruit go to Bosnia at a third of the price tomorrow, and who decides that — the CEO, the owner, or the bank?
- Three clocks on the whiteboard besides the attacker's: the CSIRT, the insurer, the data authority. Which one do you serve first, and which one do you tell your people about at 12:00?
- Which channel is still hers?
- What had to exist in September?
- Two machines flagged it, two people waved it through.
- The NEO Turn. The delivery record on the NEO stack was the one thing that did not go dark: Munich knew which loads were real before Marija did.
The bank will not take her voice; her mailbox belonged to someone else for six weeks. How does a CEO prove she is herself — to the bank, to Bepo, to Munich, to her own canteen?
The callback rule for a changed bank account, the session that survives a password reset, the IT firm's login in a spreadsheet, the assistant that read white text and wrote "no action needed" — which of these does your company have today, and who owns it?
The bank's payee check and its fraud model held the payment; the relationship manager released it on her word. Who in your company can override a machine that says stop — and who signs that they did?
What can that record tell the buyer, and what can it not; what must it hold so that on Wednesday the bank can trust anything from Opuzen at all — and what happens when the attacker's next agent asks the same record the same questions?
Moderator Note
Take Marija's seat. Your first phone call — to whom, through which channel — before anyone says the word AI. Go around the table once on that alone.
Then the money: the insurer's sub-limit, the reservation-of-rights letter, the overdraft, the payroll on the 25th. Make the room say a number and a source. Ask the production side about Bosnia and the buyer side about Munich; do not let either become the whole hour.
Third movement: September. Ask each leader for the one thing in the story their own company has not done. The callback rule, session revocation after a reset, the vendor's remote login, the scope of an assistant that reads mail. Ask the security people at the table what the two machines that flagged the payment could not know, and what the two people who overrode them should have been made to sign.
Move to the NEO Turn by asking what the delivery record can and cannot prove, and who is answerable for the difference. Close with the channel question: what would it take, in your company, for a bank to trust your voice again?
CDayZ output: a one-page "September list" for a company of this size — the five things to have before the peak season, each with a name next to it.
The NEO Turn
What changes when the attacker is not a crew but a system — one that read six weeks of mail for a few hundred euros, built a father's voice from a radio interview, wrote white text for the company's own assistant and negotiated at 03:00 in the same tone as at noon?
The company's own AI was the intruder's best employee. It had scope — the mailbox, the finance drive, the summaries the CFO acted on — and nobody had written down what it was allowed to conclude. That is the first turn: an assistant that reads is an agent that can be spoken to, by anyone who can get a document in front of it.
The second turn is the record. The delivery record on the NEO stack attested what had been authorised and what had left the yard; it decided nothing, and Munich's system read it without asking Marija. That is what a neutral record is for: the buyer, the bank and the insurer can each check the same thing without trusting a voice from Opuzen. But a record that is intact is not a record that is true — the same rail would have carried a forged authorisation with the same integrity — and anchored is not settled: the money in Vilnius was gone whatever the record said. The question for the table is what the record must hold, and who must sign into it, so that on Wednesday morning the bank can trust something from this company again.
The third turn is the channel. When voice, mail and letterhead can all be produced on demand, a leader's authority runs through the few channels that cannot be — in person, with documents, through a record both sides already trust. What are yours?
Closing line
Proposed moderator closing: "The attack did not beat the company's security. It hired the company's own tools, one by one, and nobody had told them whom to obey."
Your comment on this chapter
A question for the table, a disagreement, what you would have done. The case lead reads every comment; the ones the table takes up enter the chapter as questions from the room, with your name.