Security for Investor Relations and Communications Teams: Protect Disclosures, Accounts and Executive Voices

Investor relations and communications teams control the channels an attacker most wants to borrow: the company's official social accounts, its press release distribution, its executives' public voices and, before results day, information that moves the share price. A single false post from a hijacked corporate account or a convincing deepfake of the chief executive can move markets or trigger fraud within minutes, and the same teams must speak accurately and on time when a real cyber incident happens. This guide is for heads of investor relations, corporate communications, press offices, social media managers and the security staff who support them. It covers protecting unreleased financial information, securing official accounts and publishing tools, preparing for deepfakes of executives and running incident communications. It does not repeat collaboration platform hardening; for meeting and telephony controls see the Unified Communications Security Guide.

Source note: disclosure rules and incident details below are summarised from the SEC, FBI, NSA and CISA, X Help Center and other sources listed in the references, as checked in November 2026. NHI Mgmt Group recommendations are our practitioner guidance. Confirm against the official text before relying on it.

Key takeaways

• Official accounts are high-value identities. Protect corporate social, wire service and website publishing accounts with phishing-resistant MFA, named administrators and no shared passwords.
• Turning MFA off is an incident waiting to happen. The US SEC's own X account was taken over in January 2024 after MFA had been disabled months earlier to fix an access problem.
• Unreleased results are crown jewels. Earnings drafts, disclosure committee papers and embargoed releases need restricted storage, insider lists and controlled distribution.
• Assume your executives will be deepfaked. Agree in advance how the company verifies and denies fake audio or video, and publish where genuine statements appear.
• Incident disclosure is a joint exercise. Communications, legal, investor relations and security must rehearse how a material cyber incident is assessed and announced, including the SEC four business day Form 8-K window for US registrants.

Why these teams are targeted

Attackers value IR and communications teams for reach and credibility rather than for their data volumes. A message from an official account is believed by journalists, investors and trading algorithms. The threats fall into four groups.

Protecting unreleased financial and corporate information

IR teams handle draft results, guidance, board papers and transaction details weeks before publication. Treat this material as the most sensitive class in the data classification scheme. See the Data Classification Guide.

• Restricted repositories: keep drafts in a dedicated, access-controlled site or data room, not in general team drives or email attachments. Limit access to named individuals and review membership each reporting cycle.
• Insider and access lists: align the security access list with the legal insider list for each event, so that anyone who can open the file is known to compliance.
• Controlled distribution: share drafts with auditors, printers, wire services and advisers through the data room with watermarking and download limits, not by forwarding email.
• Labels and DLP: apply a sensitivity label to results drafts and block sending them outside the organisation or to personal accounts. See the Data Loss Prevention (DLP) Guide.
• Embargo hygiene: schedule releases in the distribution tool rather than leaving a final file in a shared inbox, and confirm who at the wire service can change or cancel a scheduled release.
• AI tools: do not paste draft results or Q&A preparation into consumer AI chatbots; use only approved, contracted AI services for non-public information. See the Shadow AI Policy Template.

Securing official social media and publishing accounts

The takeover of the US Securities and Exchange Commission's X account on 9 January 2024 is the reference case. According to the SEC, as reported by The Record, an unauthorised party took control of the phone number tied to the account through an apparent SIM swap at the carrier. MFA had been enabled but was disabled by X Support in July 2023 at SEC staff request because of access problems, and was only reinstated after the account was recovered. The false post claimed the SEC had approved bitcoin exchange-traded funds. The lessons apply to every corporate account: SMS is the weakest MFA option, and any "temporary" removal of MFA needs an owner and an end date.

For small organisations, see the Social Media Account Security for Small Businesses Guide; if an account is taken over, follow the Social Media Account Takeover Playbook.

Website and investor pages: the corporate site's investor section and newsroom are publishing channels too. Restrict CMS publishing rights for those sections to named staff with MFA, log every change, and monitor the pages for unexpected edits.

Preparing for deepfakes of executives

Executives who speak at earnings calls, conferences and media interviews leave hours of clean audio and video online, which is the raw material for voice and video cloning. In the Arup Deepfake Fraud 2024, a finance employee made 15 transfers totalling HK$200 million after a video call in which, according to Hong Kong police, the other participants were deepfakes built from public footage. In May 2025 the FBI warned that criminals were using AI-generated voice messages to impersonate senior US officials and advised verifying any such contact through an independently found number.

The NSA, FBI and CISA information sheet Contextualizing Deepfake Threats to Organizations (September 2023) sets out the defensive basis: verification for sensitive requests, real-time liveness checks, preserving and hashing suspect media, rehearsing response plans with likely targets and senior executives, training staff, and using content provenance (watermarks and C2PA Content Credentials) on authentic media.

1. Publish an official channel register: list on the investor and newsroom pages where genuine announcements are made (regulatory news service, newsroom, named social accounts). This gives journalists and investors a reference to check against.
2. Agree internal verification rules: no executive instruction to move money, share non-public information or change access is acted on from a call, video or message alone; it is confirmed through a known number or an authenticated system. See the Executive Deepfake and CEO Fraud Guide.
3. Prepare a denial process: decide who can confirm that a clip is fake, how quickly a holding statement can be issued, and how the regulatory announcement channel is used if a fake is market-moving.
4. Preserve evidence: keep the original file and URL, hash copies, and record when and where it appeared, as the information sheet recommends, before requesting takedown.
5. Sign authentic media: consider attaching Content Credentials to official video and images so that genuine material can be verified. See the AI Content Provenance and C2PA Guide.
6. Rehearse: run a tabletop exercise in which a fake CEO video announces a false profit warning on a Sunday evening, with IR, communications, legal and security in the room.

Lookalike domains, fake releases and brand impersonation

• Domain portfolio: register obvious variants of the corporate and IR domains and monitor new registrations that imitate them. See the Domain Portfolio and Lookalike Domain Management Guide.
• Email authentication: enforce DMARC at p=reject on corporate and IR sending domains, including domains that never send email, so that spoofed "investor updates" fail. See the DMARC, SPF and DKIM Guide.
• Fake executive profiles: monitor professional networks for impostor executive and IR staff profiles, and use platform reporting routes to remove them.
• Takedown process: keep a list of platform, registrar and hosting abuse contacts and who is authorised to submit requests. See the Disinformation and Brand Impersonation Guide.

Communicating during a cyber incident

For US registrants, the SEC rules adopted in 2023 require a Form 8-K under Item 1.05 for a material cybersecurity incident, generally within four business days of determining that the incident is material, and the materiality determination must be made without unreasonable delay after discovery. Disclosure can be delayed only where the US Attorney General determines that immediate disclosure poses a substantial risk to national security or public safety. Annual reports must also describe cybersecurity risk management, strategy and governance under Regulation S-K Item 106. Other markets have their own disclosure rules; confirm obligations with counsel. See the SEC Cybersecurity Disclosure Rules Guide for the detail.

Use a separate channel: if email or collaboration tools may be compromised, the incident team needs out-of-band communication arranged in advance. Assume the attacker may read drafts placed in a compromised mailbox. See the Incident Communication Plan Template and the Crisis Management Guide.

Where identity fits

Many of the identities these teams depend on are not people: social media management platforms hold OAuth tokens that can post to every corporate account, wire service and webcast platforms issue API credentials, and scheduling tools act on behalf of executives. Each connection is a non-human identity with publishing power. Keep an inventory of every app connected to official accounts, who approved it and what it can do, remove connections when an agency contract ends, and prefer platforms that support SSO and per-user roles over a single shared login. See the OAuth and SaaS integration breaches guide.

Implementation roadmap

1. Month 1, inventory: list every official account (social, wire service, webcast, website CMS, IR mailbox), its registered email and phone, its administrators and connected apps, including those run by agencies.
2. Month 1, quick wins: move registrations to corporate role mailboxes and numbers, enrol security keys for administrators, remove leavers and unused apps. Test each account's recovery path once, in daylight, rather than for the first time during an incident.
3. Month 2, information handling: set up the restricted repository and labels for results and transaction material and align access lists with insider lists before the next reporting cycle. Pilot DLP blocking in audit mode for one cycle before enforcing.
4. Month 3, deepfake and incident readiness: publish the official channel register, agree verification and denial procedures, and run one tabletop combining a deepfake and a real incident disclosure.
5. Ongoing: review administrators and connected apps quarterly and after every agency change; refresh training for spokespeople and IR staff each year. If a control blocks a time-critical publication, use a documented break-glass path with a second approver rather than removing MFA.

Small and large organisations: a small listed company may have one IR lead and an agency; the priorities are security keys, corporate ownership of accounts and a one-page incident disclosure workflow. A large issuer should add a dedicated social media management platform with approval workflows, brand and domain monitoring, and a formal disclosure committee runbook that names security representation.

Detection and measurement

• Phishing-resistant coverage: percentage of official account administrators using security keys or passkeys; target 100 per cent.
• Ownership hygiene: number of official accounts registered to personal email addresses or phone numbers; target zero.
• Access review: days since the last administrator and connected app review for each account.
• Impersonation response: median hours from detection of a fake account, domain or clip to takedown or public denial.
• Repository discipline: number of DLP events involving results drafts sent outside the restricted repository per reporting cycle.
• Readiness: date of the last tabletop that included IR, communications, legal and security.

Monitor for: logins and MFA changes on official accounts, new connected apps, posts made outside the publishing tool, changes to investor web pages, and new domains or profiles imitating the brand or executives.

Framework mapping

Common failure patterns

• MFA removed "temporarily": switched off to solve an access problem and never restored, as in the SEC X account takeover.
• Accounts owned by a person or agency: the corporate account is registered to a former employee's phone or an agency login, and recovery stalls.
• Shared passwords in a spreadsheet: one credential used by the whole team and the agency, with no record of who posted what.
• Results drafts in general drives: earnings material stored where far more people can open it than appear on the insider list.
• Trusting a familiar face on video: acting on an executive instruction because the caller looked and sounded right, as in the Arup Deepfake Fraud 2024.
• Disclosure planned during the incident: no agreed workflow, so the materiality assessment and statements are improvised under time pressure.

Practitioner checklist

• Inventory every official account, its owner details, administrators and connected apps.
• Enrol security keys or passkeys for all administrators and remove SMS where the platform allows.
• Register accounts to corporate role mailboxes and numbers, never personal ones.
• Store results and transaction drafts in a restricted repository aligned with the insider list.
• Publish an official channel register on the investor and newsroom pages.
• Agree verification rules for executive requests and a fast denial process for deepfakes.
• Enforce DMARC p=reject on corporate and IR domains and monitor lookalikes.
• Rehearse a cyber incident disclosure with IR, communications, legal and security at least yearly.

Standards and references

• US SEC: Public Company Cybersecurity Disclosures Final Rules fact sheet
• NSA, FBI and CISA: Contextualizing Deepfake Threats to Organizations
• FBI IC3: Senior US Officials Impersonated in Malicious Messaging Campaign
• X Help Center: How to use two-factor authentication
• C2PA: Coalition for Content Provenance and Authenticity
• The Record: SEC blames SIM swapping for X account takeover

Related NHI Mgmt Group resources: Deepfake and AI Impersonation Guide · Unified Communications Security Guide · SEC Cybersecurity Disclosure Rules Guide · Social Media Account Takeover Playbook