With everyone chasing the latest AI innovation, are we overlooking the fundamental security and efficiency practices that protect both ourselves and our colleagues? Tim Stackpool on the unglamorous essentials that matter most.
EAs are increasingly recognised as cybersecurity’s frontline defenders. According to Verizon’s 2025 Data Breach Investigations Report, 60% of breaches involved the human element.
And high-level assistants managing executive inboxes, handling sensitive communications and coordinating confidential meetings are prime targets for sophisticated attacks.
The risks are real. In one high-profile case, a British CEO was tricked into wiring $243,000 to scammers using AI-generated voice impersonation technology. Technology cuts both ways.
Password management: your first line of defence
Password reuse remains one of the most dangerous yet common practices. The 2024 Global Password Management Survey by Bitwarden found 84% of respondents admitted to reusing passwords across multiple accounts, with 47% acknowledging they do this at work.
For those managing executive calendars, email accounts and confidential documents, a single compromised password can unlock catastrophic access.
The National Institute of Standards and Technology in the United States recommends passphrases of at least 15 characters over complex but short passwords.
Think “breadandbutteryum” rather than “P@ssw0rd1”. Better still, if not already implemented, discuss with your IT department the use of a password manager tool. These generate unique, complex passwords for every account and store them securely, eliminating the temptation to reuse credentials.
Multi-factor authentication (MFA) provides a critical second layer of security. Even if your password is compromised, MFA requires additional verification, typically through your mobile device. Enable it on every account that offers it, particularly email, cloud storage and any platform containing executive information.
The 3-2-1 backup rule: insurance you hope never to claim
Data loss can cripple operations in minutes, whether from hardware failure, ransomware or human error.
The 3-2-1 backup rule provides straightforward protection: maintain three copies of your data, on two different types of storage media, with one copy stored off-site (if your company’s information policy allows it).
For example, keep your original files on your computer, back them up to an external hard drive in your office, and use a cloud backup service such as Microsoft OneDrive or Google Drive as your off-site copy.
The United States Computer Emergency Readiness Team has endorsed this approach since 2012 and it remains the gold standard for data protection.
Automation is essential. Manual backups inevitably fail when life gets busy. Configure your backup software to run automatically during off-peak hours and, critically, test your backups quarterly by actually restoring files. A backup you haven’t tested is merely a theory.
Securing your digital footprint
Research by BlackCloak found 99% of executives have personal information listed on more than three dozen online data broker websites, with 40% of these profiles containing home network IP addresses. As an EA, you can help mitigate these risks by implementing basic security hygiene.
Never click links in unexpected emails, even if they appear to come from known contacts. Verify unusual requests through a secondary channel. If working from home, secure your networks with strong Wi-Fi passwords and updated router firmware.
Document these protocols clearly. Create a simple, accessible security checklist that covers password updates, backup verification and suspicious activity reporting. Share it with your IT colleagues and revisit it quarterly.
The bottom line
While AI tools promise efficiency gains, they’re sometimes accessed on foundations that haven’t been properly secured.
Audit your current practices:
- Are you reusing passwords?
- When did you last test a backup restoration?
- Is MFA enabled on all critical accounts?
These aren’t glamorous habits, but they’re the difference between a manageable incident and a crisis. Master the basics and you’ll deliver something AI never can – real peace of mind.
