Jamie Dimon Warns Business Leaders to Strengthen Cybersecurity

Why Business Leaders Should Pay Attention to Jamie Dimon’s Cybersecurity Warning

Cybersecurity has become a business risk that executives need to manage, not just something for the IT department.

In October 2026, JPMorgan Chase CEO Jamie Dimon urged business leaders to increase their cyber defenses in response to the growing risks associated with advanced artificial intelligence. His recommendations included improving network segmentation, strengthening identity and access management, and using powerful AI tools to identify weaknesses in existing systems. He also emphasized that businesses need to make fixing security gaps an ongoing management priority. (The Wall Street Journal)

This warning is important for companies of every size.

Artificial intelligence can help security teams spot weaknesses faster, but it can also help attackers find and exploit gaps companies miss. This puts pressure on businesses to know their risks, fix problems in order of importance, and be ready to respond if something happens.

For business leaders, cybersecurity is about more than just antivirus software, firewalls, or cyber insurance.

The real question is whether your company’s security measures can prevent an attacker from turning a single weakness into a larger problem.

You don’t have to run a big bank to face this challenge. If your company uses email, cloud apps, customer databases, remote access, or third-party software, you have valuable systems and information to protect.

The good news is that the most important improvements often don’t require new security products. They usually begin with understanding how your systems connect, who has access, and how quickly your company can fix problems.

AI Is Changing the Speed of Cybersecurity

For years, businesses have faced the same cybersecurity challenge: finding weaknesses before criminals do.

The problem is that finding weaknesses takes time. Security teams must identify systems, check settings, analyze software, test defenses, and determine which issues matter most.

AI can speed up some of this work.

Advanced AI tools can help analyze code, identify vulnerabilities, review technical configurations, and assist with security research. These capabilities can help defenders find problems that might otherwise go unnoticed.

But attackers can also use these same tools.

Imagine a burglar who once had to inspect a building manually, testing doors and windows one at a time. Now imagine that burglar has a tool that can rapidly identify likely entry points across hundreds of buildings.

The buildings themselves haven’t suddenly become weaker. What’s changed is how quickly someone can find a weakness.

This is what worries cybersecurity teams. As AI improves, companies may have less time to find and fix weaknesses before attackers do.

This doesn’t mean every business will suddenly face more attacks or that older security controls no longer work. It means companies need to make sure their current processes and protections can keep up with new threats.

A vulnerability left unresolved for months can create a different level of exposure when attackers can discover weaknesses almost instantly.

For business leaders, this means it’s even more important to fix problems quickly.

Your Security Is Only as Strong as Your Connections

One of Dimon’s recommendations was network segmentation. The term sounds technical, but the idea is simple.

Think of your company’s technology environment as an office building.

A small business might have a reception area, employee offices, an accounting department, a records room, and a server room. You would not normally give every visitor unrestricted access to every room.

Instead, you would use doors, keys, badges, and other restrictions to separate areas by purpose.

Network segmentation applies a similar principle to computer systems.

Instead of allowing every device and system to connect freely, a company sets up boundaries to block unnecessary connections. These boundaries can separate employee devices from critical servers, keep guest Wi-Fi apart from business systems, or divide production systems from administrative areas.

Why does this matter?

Imagine an attacker compromises an employee’s laptop through a malicious email attachment. If that laptop can communicate freely with sensitive servers, the attacker may have a path toward more valuable systems.

If the company has properly designed network boundaries, the compromised laptop may have limited access. The attacker must overcome additional controls to move further into the environment.

Segmentation doesn’t guarantee that an attack will stop. Weak boundaries, too many permissions, or compromised admin accounts can still let attackers in. However, good segmentation makes it much harder for an attacker to move deeper into your systems.

This is the difference between a building with one unlocked entrance and a building with separate, controlled areas.

A strong security program doesn’t assume it can stop every attack. It also limits the damage if prevention fails.

Identity and Access Management: Who Has the Keys?

Another area Dimon highlighted was identity and access management.

Identity and access management, or IAM, is how a business decides who can access its systems and what they can do.

Consider a physical office.

Employees have badges. Managers may have access to additional areas. Contractors receive access only where needed. When someone leaves the company, their badge stops working.

Digital access should work the same way.

An employee’s account might provide access to email, financial software, customer records, shared files, and cloud applications. If the employee has more permissions than their job requires, an attacker who compromises that account may receive those excessive privileges.

That’s why businesses should regularly review user accounts, admin privileges, authentication steps, and access for former employees or contractors.

Multi-factor authentication (MFA) is another key control. It asks users for something extra beyond a password, like an app approval or a security key.

A password is like a key to a door. MFA adds another layer of security, so a stolen password is less useful to an attacker. While MFA isn’t perfect, especially against advanced phishing or session theft, it can greatly improve protection when used properly.

Businesses should pay particular attention to accounts with elevated privileges. An administrator account may create users, change security settings, access sensitive records, or control critical systems.

Giving that account more access than needed is like handing out a master key to everyone in the building.

A good access management program gives people only the access they need, blocks what they don’t, and reviews permissions when roles change.

Finding a Vulnerability Is Only Half the Job

Dimon also emphasized using advanced AI tools to find weaknesses and the need to fix those weaknesses. That second part deserves particular attention.

Many companies already receive security alerts, vulnerability scan results, software update notifications, and vendor recommendations.

The challenge isn’t always a lack of information.

The real issue is deciding what matters most and making sure the work gets done.

Imagine a building inspector identifies several problems: a loose handrail, a broken exterior lock, and a fire door that no longer closes. The building owner needs to understand which issues create the greatest risk, who will correct them, and when the work will be finished.

A vulnerability report creates a similar management challenge.

One finding may affect an isolated test system. Another may expose an internet-facing application that stores sensitive customer information. A third may allow an attacker to move from an employee workstation to a critical server.

Treating every issue the same way wastes time and resources.

A company has to prioritize vulnerabilities based on whether attackers are exploiting them, whether the affected system is accessible from the internet, what information or business functions it supports, and whether an attacker could use the weakness to reach other systems.

This is called risk-based remediation.

The goal isn’t just to have fewer vulnerabilities. It’s to fix the weaknesses that could cause the most harm to your business.

Tanner Security discusses this distinction in its article on how AI is finding vulnerabilities faster than companies can patch them.

AI Can Help Defend Your Business, but It Is Not a Replacement for Security Fundamentals

It’s easy to think that the rapid growth of AI security tools means you should buy the newest product.

AI can help security teams analyze information, identify patterns, investigate alerts, and discover issues. However, these tools’ effectiveness depends on the environment they examine and the people and processes responsible for acting on their results.

AI tools can’t compensate for a company that doesn’t know its systems, allows too much access to sensitive data, or leaves major weaknesses unaddressed.

You can think of AI as a helpful inspection tool.

It might help an inspector find problems faster, but it won’t fix the building by itself. Someone still needs to review the findings, decide what to fix, do the work, and make sure the problem is solved.

Businesses should therefore evaluate AI security tools as part of the whole security program that includes asset management, access controls, vulnerability management, monitoring, incident response, and independent security testing.

Companies using AI in their own applications should also assess risks specific to those systems, including data exposure, insecure integrations, unexpected model behavior, and inadequate human control.

Tanner Security’s AI Risk Assessment services help businesses understand where they use AI, what information those systems can access, and what governance and security controls they may need.

What Business Leaders Should Do Now

The best way to handle growing AI-driven cyber risks isn’t to panic or buy every new security product. Instead, focus on understanding your company’s biggest risks and make sure the right people are addressing them.

Start by identifying the systems that matter most to your business. These may include financial applications, customer databases, employee records, production systems, email, cloud services, and applications that support key operations.

Next, examine who can access those systems and how far an attacker could move if one account or device became compromised. Review administrator permissions, MFA coverage, remote access, and the boundaries separating critical systems from ordinary employee devices.

Then, examine how the company handles vulnerabilities. Does it know which weaknesses are most urgent? Does someone own each significant remediation task? Can management see overdue high-risk issues? Does the company verify that fixes work?

Finally, consider whether your current security controls have been independently tested. Policies and configuration reviews can tell you what controls should exist. Security testing can help determine whether those controls work as intended under realistic breach scenarios.

These steps should work together. If a company finds a vulnerability but can’t prioritize it, assign responsibility, or fix it, the risk remains unmanaged.

How Independent Cybersecurity Assessments Help

A company can invest in security products and still have gaps between its intended protections and how its systems actually operate.

An independent cybersecurity assessment helps management understand IT gaps.

Depending on the company’s needs, an assessment may evaluate identity and access controls, network architecture, cloud security, vulnerability management, policies, monitoring, and other safeguards. Penetration testing can go further by attempting to exploit weaknesses within an agreed scope and determining what an attacker could potentially access.

For example, a company may believe that its employee network is separated from its critical servers. Testing can help determine whether that separation actually prevents unauthorized access or whether another route remains available.

A company may require MFA for remote access. An assessment can examine whether important accounts and access paths receive appropriate protection.

A company may receive regular vulnerability reports. A risk assessment can help determine whether its remediation process focuses on the issues most likely to affect business operations.

The real value isn’t just in finding more problems. It’s in helping leaders see which gaps matter most, what to fix first, and how to track progress.

Tanner Security provides IT risk assessments, penetration testing, vulnerability assessments, and other cybersecurity services to help businesses evaluate security controls and make practical improvements.

Cybersecurity Is Key to Business Resilience

Jamie Dimon warned of a larger challenge: as technology and attack methods evolve, businesses must continually evaluate whether their defenses remain effective.

That does not mean every company needs the same tools or the same security budget. A small professional services firm has different needs from a bank or manufacturer.

But every company should know what systems it relies on, protect sensitive information, limit unnecessary connections, fix serious weaknesses, and be ready to respond if an attack happens.

You can think of cybersecurity like fire protection.

A smoke detector is helpful, but it can’t replace fire doors, a clear evacuation plan, good maintenance, or a way to put out a fire. Real protection comes from several safeguards working together.

Cybersecurity works the same way. Prevention is important, but so are containment, detection, response, and recovery.

The goal isn’t to guarantee your company will never face a cyberattack. The actual goal is to make attacks harder, limit damage, and help your business recover faster.

Is Your Company’s Cybersecurity Ready for the AI Era?

AI is making it faster to find and test security issues. Now is a good time for business leaders to see if their defenses are keeping up.

Can an attacker move freely from one compromised device to critical systems? Do employees and administrators have more access than they need? Are the most serious vulnerabilities being fixed promptly? Does leadership understand the remaining risks?

If your company cannot answer those questions confidently, an independent assessment can provide a practical starting point.

Tanner Security helps businesses evaluate their security controls, identify weaknesses, and prioritize improvements based on business risk—not simply the number of technical findings.

Contact Tanner Security to discuss how an independent cybersecurity assessment can help your business strengthen its IT controls and manage emerging cyber risks.

Explore Tanner Security’s Cybersecurity Assessment Services

Related Tanner Security Services

Depending on your company’s needs, these services can help strengthen different parts of your cybersecurity program:

• IT Risk Assessments and NIST IT Audits
• AI Risk Assessment Services
• Red Team Penetration Testing
• Cybersecurity Risk and Control Reviews

A well-designed security program connects these activities so the company can identify risks, test its defenses, and address weaknesses before they cause serious business disruption.