Skills
About
Ritesh is a seasoned executive with deep cybersecurity expertise across both public and private sectors. As the head of cyber-intelligence and counterterrorism of a national intelligence agency, he has honed his expertise in cybersecurity working in the front lines of cyber war. Extending his expertise to IBM Research, Ritesh has built ground-breaking products that have been deployed in many industries. Combined with his role as an executive with PWC running large cyber consulting programs and the global CISO of one of the world’s largest mining companies, Ritesh has the unique experience to see a cybersecurity challenge from the lens of a practitioner, an innovator and a business leader.
Kumar Ritesh
Published content
expert panel
A routine IT support call might seem like an unlikely starting point for a major cyberattack. But in 2023, hackers reportedly gained access to MGM Resorts’ systems by impersonating an employee in a call to the company’s help desk. The resulting breach disrupted casino operations, hotel room access and payment systems, demonstrating how a seemingly ordinary support interaction can have serious business consequences.The threat has since flipped direction: Instead of posing as employees to fool the help desk, attackers are now posing as the help desk to fool employees. In a series of 2026 extortion campaigns, callers impersonated IT support staff, sometimes spoofing the company’s real help desk number. They reached employees on personal phones, outside corporate security controls, and pressed them to complete an urgent passkey or multifactor authentication enrollment. Victims were steered to lookalike login pages that captured both their passwords and MFA tokens, giving attackers access to corporate cloud services from which they stole data for extortion.Such attacks expose a troubling weakness: The more organizations train employees to cooperate with security changes, the easier it becomes for criminals to disguise an attack as a legitimate update. The challenge for businesses is to make sensitive support interactions more trustworthy without making assistance frustrating or time-consuming. Employees need confidence that requests are authentic, while IT teams need to resolve account problems and restore access without unnecessary delays. Members of the Senior Executive Cybersecurity Think Tank bring expertise in identity security, risk management and enterprise cyber defense to this challenge. Below, they explore how organizations can strengthen verification across help desk, identity enrollment and account recovery processes while keeping support efficient and accessible.
expert panel
Cyber exercises give an organization a chance to uncover weaknesses before a real attack puts its response to the test. Yet what teams rehearse often differs from what they face. A 2025 survey of 480 senior U.S. cybersecurity leaders found that 57% of significant cyber incidents involved attacks the security team hadn’t prepared for. Since no organization can rehearse every scenario, the value of an exercise lies less in the script than in whether it builds the judgment and coordination a response will need when events don’t go according to plan. A scenario that simply walks the security team through familiar technical steps reveals little about how the business would function when a critical vendor goes dark, core systems are unavailable, or executives must make high-stakes calls about operations, disclosure and customer communication with incomplete information. CISA has advised that incident response plans include senior business leadership and board members and that senior management participate in tabletop exercises, reflecting the view that cyber readiness must extend well beyond the security team.Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategy, risk management, incident response and cybersecurity leadership. Below, they explore what separates a useful cyber exercise from a compliance-driven tabletop and how leaders can design exercises that test executive judgment, operational dependencies and cross-organizational coordination.
expert panel
AI can create value quickly, but every new model, agent and AI-enabled workflow can also add another layer of complexity for security teams to understand and protect. When adoption—sanctioned or not—moves faster than visibility and governance, organizations can begin accumulating AI risk debt: unresolved exposures, unclear ownership and controls that may no longer match how the technology is actually being used. Recent research underscores that gap: Less than half of the security leaders surveyed said their companies knew all the AI agents operating on their networks, and less than half said they controlled those agents’ access to corporate data.The challenge is that this debt doesn’t necessarily show up as a single, obvious vulnerability. It can build quietly as AI systems become more capable, new uses emerge and dependencies multiply, leaving security programs trying to manage risk across a moving target. As AI agents evolve from tools that assist employees into systems capable of acting across enterprise environments, companies are confronting governance and security questions for which established practices are still developing.For security leaders, the question is where that growing gap between AI adoption and effective oversight poses the greatest danger—and how to close it before the debt becomes harder and more expensive to unwind. Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategy, data breach prevention, risk management, regulatory compliance and modern security architecture. Below, they explore where AI risk debt is accumulating most dangerously and what security leaders can do now to bring it under control.
expert panel
As companies move more critical systems and data into cloud and SaaS environments, investigating a cyber incident can become a complicated exercise in reconstructing events across systems an organization doesn’t fully control. If important evidence is unavailable or incomplete, determining what happened—and demonstrating what did or didn’t happen—can become much harder. NIST’s work on cloud forensics highlights the distinct challenges investigators face when collecting and analyzing evidence in cloud computing environments.Access to that evidence isn’t always a given. In 2024, CISA, OMB and ONCD worked with Microsoft to expand cloud audit logging for federal customers regardless of license tier and increase default retention from 90 to 180 days, part of a broader push to make critical security logs available without added licensing barriers. That highlights a larger business risk: An organization may discover the limits of its forensic visibility only after an incident, when legal teams, regulators and insurers are looking for clear answers.Cybersecurity leaders therefore need to look beyond whether their cloud environments can detect suspicious activity and determine whether those environments can support a credible investigation after a breach or other security incident. Members of the Senior Executive Cybersecurity Think Tank bring deep experience in enterprise security, incident response, risk management, regulatory compliance and cloud security. Below, they examine how leaders can strengthen forensic readiness before an incident occurs and where evidence gaps can create the greatest problems once an investigation is underway.
expert panel
Cybersecurity teams have always had to distinguish legitimate activity from malicious activity, but external AI agents make that judgment call harder. Unlike a conventional user session or scripted bot, an agent can pursue a goal across multiple steps, adapt as conditions change and operate at a speed and scale that can far exceed human activity.The challenge grows when organizations are interacting with agents they didn’t build, deploy or directly control. Those agents may be acting on behalf of customers, vendors or business partners—or probing systems for an attacker—and their behavior can evolve in real time. In a recent real-world example, AI agents run internally by OpenAI found an unintended path to the internet while trying to complete an evaluation, then breached Hugging Face systems in an effort to obtain information that could help them finish the task. The incident illustrates how quickly an autonomous system can move beyond the boundaries its operators expected.For cybersecurity leaders, that raises a broader question: How do you defend systems when the actor at the other end may be autonomous, adaptive and outside your control? Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity, risk management, threat detection and modern security architecture. Below, they explore how defensive strategy should evolve as external AI agents become more capable and which protections matter most when agent-driven activity originates beyond the organization.
expert panel
Software supply chain security is often treated as a gatekeeping problem: Keep malicious code from entering the environment. But modern applications are built from dense webs of open-source and third-party dependencies, and a single compromised package can surface across numerous applications and systems downstream, far beyond the first project that installs it.Recent attacks have shown how quickly that risk can multiply. In September 2025, the self-replicating Shai-Hulud worm infiltrated the npm ecosystem through compromised maintainer accounts, spreading automatically across the registry by hijacking developer credentials. By the time it was contained, the worm had compromised more than 500 packages, prompting GitHub to remove them from the registry to stop further propagation.For security leaders, the challenge isn’t only determining whether a package is safe at the point of entry—it’s understanding how far a compromise could travel once that software is already embedded across an organization. Supply chain risk is compounded when organizations lack visibility into how the technology they rely on is developed, integrated and deployed.Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategies, data breach prevention, risk management, threat detection and modern security architecture. Here, three of them examine how leaders should assess the downstream risk posed by poisoned software dependencies and what meaningful prevention and containment look like when a single compromised component has the potential to affect many systems.
Company details
CYFIRMA
Company bio
CYFIRMA is a global leader in preemptive external threat landscape management, enabling organizations to predict and prevent cyberattacks through its AI-powered intelligence platform. By integrating nine pillars of external threat management including Attack Surface Discovery, Vulnerability Intelligence, Brand & Digital Risk Management, Third-Party Risk, Situational Awareness, Predictive Threat Intelligence, Threat Adaptive Awareness, and Sector-Tailored Deception Intelligence, CYFIRMA shifts cybersecurity from reactive to predictive. The platform delivers early warnings, personalized insights, and actionable intelligence from a hacker’s perspective, helping reduce cyber risk and costs through threat prioritization, contextual decision-making, improved visibility, and stronger operational resilience. CYFIRMA serves Fortune 500 companies and national agencies and is headquartered in Singapore with offices across APAC, the US, and EMEA.