A business can have expensive security software, strict password policies and a team responsible for protecting its systems, yet still lose control of valuable information. Sometimes the problem is not a sophisticated cyberattack. It is an employee with excessive access, an overlooked account, a poorly managed supplier or a transaction that nobody properly verified.
These weaknesses point to a problem that deserves more attention: how businesses keep control of their digital assets and who they trust to manage them. Stronger custody arrangements and cybersecurity standards are necessary because protecting information is one thing; ensuring that the right people retain control over it is another.
Who Actually Controls a Business’s Digital Assets?
Businesses increasingly depend on information they cannot afford to lose or expose. Customer databases, financial records, intellectual property, business accounts, confidential documents and digital assets all require proper protection.
But storing these assets securely is only part of the responsibility. Businesses must also establish who can access them, who can authorize changes, where copies are kept and what happens when an employee leaves or an external service provider experiences a security breach.
Consider a company that gives several employees access to its customer database. One employee needs the information to handle customer complaints, while another needs it to prepare reports. Should both have permission to download, modify or delete the entire database? Probably not.
Yet businesses sometimes grant broad permissions because they are convenient. Over time, accounts accumulate access rights, former employees retain permissions and nobody takes responsibility for reviewing them. A small administrative oversight can become a serious security weakness.
Security Failures Do Not Always Begin With Sophisticated Attacks
The 2019 Binance security breach provides a useful example of what can happen when access controls and transaction safeguards fail.
On May 7, 2019, attackers stole 7,000 bitcoin from Binance’s hot wallet, valued at approximately $40 million at the time. The company said the attackers had obtained user API keys, two-factor authentication codes and other information through methods including phishing and viruses.
In October 2026, Binance disclosed a major security breach involving its hot wallets, resulting in an estimated loss of approximately $6.3 billion in digital assets. In its October 30 security update, the exchange said its initial investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have allowed attackers to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were leaked and would cover the losses using its SAFU fund and corporate funds.
The incident is particularly relevant because it shows that having security measures in place does not guarantee that they will prevent unauthorized activity. Attackers can exploit the people, accounts and processes surrounding a system rather than trying to break the underlying technology.
The same problem can affect an ordinary business. An attacker who gains control of an employee’s email account might impersonate a senior manager, request confidential documents or send fraudulent payment instructions. If nobody independently verifies the request, an otherwise preventable incident can become an expensive mistake.
Custody Responsibilities Should Never Be Assumed
One weakness in many organizations is the lack of clear ownership over digital information. The IT department may manage the systems, employees may handle the records and an external company may provide storage. But who is ultimately responsible for ensuring that everything remains protected?
Businesses need a clear answer. Someone should be accountable for approving access, reviewing permissions, monitoring sensitive activity and ensuring that important information can be recovered.
This becomes even more important when a business manages information or assets belonging to customers. Customers should not have to depend on informal promises that their information is safe. Businesses should be able to explain how it is stored, who can access it and what protections apply if the company experiences a serious failure.
Third-party providers deserve particular attention. A business might carefully protect its own systems but still expose customer information through an external supplier with weaker security practices. Before granting a provider access to sensitive information, companies should examine its security arrangements and establish clear responsibilities for protecting that information.
Stronger Standards Require More Than Passwords
Passwords remain necessary, but they cannot carry the entire responsibility for protecting business systems. Reused passwords, phishing attacks and stolen login details can undermine an organization’s security, even when employees are told to follow strict password policies.
Multi-factor authentication adds another verification step, making it harder for someone to enter an account using a stolen password alone. Businesses should apply it particularly to email, administrative accounts, financial systems and other services that control sensitive information.
Access should also reflect an employee’s actual responsibilities. Someone who needs to view a document should not automatically receive permission to change or delete it. Sensitive transactions should have appropriate approval procedures, preferably with independent verification when large amounts of money or valuable assets are involved.
Another frequently overlooked issue is recovery. Businesses need protected backups of important information, but simply creating copies is not enough. Those backups must remain accessible during an emergency without exposing them to the same attack that affected the original systems.
The NIST Cybersecurity Framework 2.0 provides guidance on managing these responsibilities through governance, risk identification, protection, detection, response and recovery. It gives businesses a useful way to assess whether their security arrangements cover more than preventing unauthorized access.
What Happens When a Business Cannot Recover?
Preventing attacks deserves attention, but businesses should also prepare for the possibility that prevention will fail.
A ransomware attack could make important files inaccessible. An employee might accidentally delete records. A compromised administrator account could disrupt essential services. In each case, the damage depends partly on whether the business has a practical recovery plan.
Companies should know which systems need to be restored first, who can authorize emergency action and how affected accounts will be secured. They should also test their recovery arrangements instead of assuming that everything will work when needed.
Independent security assessments can help expose weaknesses that internal teams have overlooked. These reviews should examine actual access permissions, backup arrangements, supplier controls and the procedures used to approve sensitive actions. Finding a problem is useful; leaving it unresolved is not.
Cybersecurity Is a Business Responsibility
Business leaders sometimes treat cybersecurity as a technical expense that can be delegated entirely to IT staff. That approach overlooks the financial and operational consequences of losing control over company information or customer assets.
Management needs to understand what the business holds, who controls it and whether the existing safeguards are adequate. Employees also need to understand their responsibilities because a security policy cannot protect an organization if the people using its systems routinely ignore it.
Stronger custody arrangements are ultimately about accountability. A business should know where its digital assets are, who can reach them and how their security will be maintained when employees change, suppliers fail or attackers gain access. Without those answers, even sophisticated cybersecurity systems may leave important gaps.
Protecting a business’s digital assets should never depend on everyone doing the right thing by chance. The responsibility needs to be built into how the business operates.
