Cyber Incident on Your Watch: How CFOs Talk About It in Interview
More CFOs now have a cyber incident in their history.
Ransomware, payment fraud through hacked email, data breaches, system outages caused by attacks. These events have hit businesses of every size and sector across Australia and New Zealand. CFOs are often at the centre of the response, because cyber incidents affect cash, payments, systems, insurance, reporting and the board.
That means CFO interview panels now ask about it. Either directly, “Have you been through a cyber incident?”, or through broader questions about risk and crisis.
This article covers why panels ask, how to structure your answer, how to talk about working with the board, insurers and regulators, and how to show cyber readiness on your resume. Keep descriptions general and do not name specific incidents or attackers.
Why panels ask about cyber now
Boards see cyber as one of their biggest risks. They want a CFO who:
Understands the financial and operational impact of an attack
Can keep payments and reporting going during disruption
Works well with IT, legal, insurers and regulators
Communicates calmly with the board
Helps the business recover and improve
In many businesses, the CFO also oversees IT or has a close role in technology spending and risk. See technology, cyber and AI board directors for the board-level view.
What you knew, what you did, what changed
Use a simple structure for your answer:
What happened. In general terms. The type of incident and its impact.
What you knew and when. How you found out and what was unclear at first.
What you did. Your actions in the first days and weeks.
What changed. The improvements that followed.
What you learned.
Example answer:
"In 2024, we had a ransomware attack that took our main finance and operations systems offline for six days.
I was told on a Saturday morning. At first, we did not know how far it had spread. I joined the crisis team with the CEO, the IT lead and our external advisers.
My priorities were cash, payments and the board. We moved to manual payment processes with extra checks, so staff and key suppliers were paid on time. I briefed the chair daily. I worked with our insurer and legal advisers from day one.
We restored systems within a week. Afterwards, I led a review that added stronger backup controls, multi-factor approval on all payments and a tested recovery plan.
The biggest lesson was the value of a practised plan. We had one on paper, but we had not tested it. Now we test it twice a year."
Working with the board, insurers and regulators
Panels want to know how you handled the key relationships.
Board. Regular, honest updates. What you know, what you do not, and what you are doing.
Insurers. Early notification and close cooperation. Cyber insurance terms often require prompt notice and specific steps.
Regulators. Depending on the incident and the business, there may be obligations to notify regulators or affected people. These are usually handled with legal advice.
Banks and lenders. Keeping them informed if payments or reporting are affected.
Staff and customers. Clear, consistent communication.
Payment fraud through email
One of the most common cyber incidents for finance teams is payment fraud. A supplier’s email is hacked, or a fake email asks for a change in bank details, and money is sent to the wrong account.
If this happened on your watch, be honest. Focus on what you did and what changed.
“We lost $180,000 when a supplier’s email was compromised and bank details were changed. We recovered $120,000 through quick action with the bank. I introduced a call-back process for all bank detail changes and dual approval on new payees. There have been no further losses.”
What you learned
The learning is often the most important part of the answer. Common lessons include:
Test your plan, not just write it
Know your cash position daily in a crisis
Have manual payment processes ready
Involve the insurer early
Communicate more, not less
Showing cyber readiness on your resume
You do not need to describe the incident in detail. Show the improvements.
“Led the finance response to a major cyber incident, maintaining payroll and supplier payments throughout and restoring full reporting within a week.”
“Introduced payment controls that removed email-based payment fraud risk.”
“Led a cyber resilience program across finance, including tested recovery plans and multi-factor approvals.”
If you have not been through an incident
Many panels ask how you would handle one. Answer using the same structure, as a plan.
“My first priorities would be cash, payments and communication with the board. I would want to know our recovery plan, our insurer’s requirements and our manual payment process before any incident happens.”
Common mistakes
Giving too much technical detail
Blaming the IT team
Naming attackers or sharing sensitive details
Not showing what changed afterwards
Claiming nothing could have been done better
How search consultants view cyber experience
In my executive search work, crisis experience of any kind was valued. Today, cyber incidents are one of the most common crises. A CFO who can describe a calm, structured response and real improvements afterwards stands out.
Your profile
If cyber resilience is part of your experience, add a short line. “CFO with experience leading finance through a major cyber incident and building stronger payment and recovery controls.”
A quick self-check
Do you know, today, how your business would pay staff and suppliers if systems went down for a week? If not, find out. It will make you a better CFO and a stronger interview candidate.
When the CFO also runs IT
In many mid-sized businesses, the CFO oversees IT. If that is you, panels will expect more. They will ask about your cyber strategy, investment decisions and how you work with IT leaders and external providers. Be ready to show how you balance cost, risk and resilience.
“Oversees IT, including a $2 million cyber program that moved the business from a failed external test to a clean result within a year.”
Cyber insurance
Panels may ask about cyber insurance. Know the basics: what your policy covered, how you worked with the insurer during an incident and what changed in the policy afterwards. Keep it general and accurate, and avoid quoting policy figures.
Your LinkedIn
If you have led a cyber response or resilience program, add one line about it to your LinkedIn experience. Boards and search consultants increasingly look for this.
Talking to the board after an incident
After an incident, the board will want a full review. The CFO often leads or supports it. Show that you presented clear lessons and a plan, not just a summary of what happened.
Staying current
Cyber risks change fast. Show that you keep learning: board briefings you have attended, training you have completed or tests you have run. It tells a panel you treat cyber as an ongoing part of the CFO role, not a one-off project.
Your next step
Write your cyber story, or your cyber plan, using the five-step structure. Keep it to two minutes when spoken.
If you want help preparing for CFO interviews, my executive interview preparation helps senior finance leaders prepare clear answers to hard questions.
If you have an interview coming up, book a complimentary Clarity Session.
