Cybersecurity Awareness Month

A note from our CISO April Sather

April Sather Cybersecurity Awareness Month is an opportunity to recognize that every aspect of our mission – and the trust placed in us by our communities – depends on strong cybersecurity. Artificial intelligence is changing the threat landscape, giving attackers new ways to create convincing social-engineering messages, impersonate trusted individuals, and target our staff and systems at scale. AI is also accelerating vulnerability exploitation, leaving us less time to identify and address weaknesses. UCOP continues to evolve our defenses to meet this moment.

In parallel, we are committed to securely enabling staff to use AI in productive and responsible ways; visit the UCOP Artificial Intelligence Hub for the latest guidance and resources, including new agentic AI security guardrails. One of the most important drivers of successful AI outcomes is quality data. By keeping only the data we need and disposing of information appropriately when it is no longer required, we achieve two things: provide a strong foundation for trustworthy AI and reduce our target size for cybercriminals. Data we don’t have cannot be stolen. Following the UC records retention schedule helps us manage information responsibly, meet our legal and operational obligations, reduce unnecessary costs, and limit the potential impact of a security incident.

Security is a shared responsibility, and our everyday choices truly matter. Use strong, unique passwords and multifactor authentication; pause before responding to unusual requests; install updates promptly; report suspected phishing or other concerns; and secure your devices wherever you work. I encourage everyone to take part in Cybersecurity Awareness Month activities and attend upcoming events, including the UC Cybersecurity Summit and other sessions hosted across our system.

Warm regards,

April Sather
UCOP Chief Information Security Officer
UC Systemwide Cyber Defense Officer (Interim)

By the numbers

82%
of enterprises surveyed discovered AI agents that security or IT did not previously know about. ¹
$5M
was the global average cost of a data breach, a 12% increase over the previous year. ²
56%
increase in AI-driven attacks, led by deepfake impersonations and AI-enabled malware. ²
$3B
in losses due to business email compromise. ³
500%
increase in ClickFix attacks. ⁴
40%
higher success rate in mobile social-engineering attacks than traditional email phishing. ⁴

Note: Some resources link to SharePoint and may require you to sign in with your UCOP credentials.

What can you do?

Notice alerts and notifications, especially those indicating that account information has changed (such as direct deposit information, passwords, or phone numbers) or that a device or application is vulnerable or requires an update.
Enable Multifactor Authentication (MFA) whenever possible.
Report incidents or suspected incidents to cybersecurity@ucop.edu – Minutes Matter!
Watch for phishing (email), smishing (text/SMS messages), quishing (QR codes) and phone/voice calls from attackers trying to convince you to take urgent action. Social engineering remains a serious threat.
Protect your identity. Sign up for the free Experian employee identity protection program.

Security Partner Profile
Sugey Ochoa

Sugey Ochoa’s career at UCPath spans more than thirteen years. She has watched UCPath evolve from its legacy operations into the modern environment it is today, growing alongside it and becoming a trusted leader in the process. Today, she oversees five teams of supervisors and frontline staff who support employees with benefits, payroll, personal information, and emerging security concerns. Her work is grounded in more than twenty years of leadership experience and an MBA in Information Systems, shaping a problem-solving approach rooted in people, process, and technology.

Ochoa’s path into this work reflects her genuine interest in people and her ability to navigate complex, high-pressure situations with clarity and composure. “I enjoy interacting with people,” she explained. “Even though no one likes working under stress, I thrive in problem-solving environments.” She encourages her staff to approach each inquiry with patience, empathy, and curiosity, reinforcing the importance of thoughtful engagement and consistent support for employees.

Since late 2023, UCPath has seen a significant rise in security-related incidents using artificial intelligence (AI) to gather public information, craft convincing phishing messages, or impersonate employees. “Threat actors are getting very innovative,” she noted. “With AI, they can pull public information instantly. We have to stay vigilant.” As a public institution, UCPath’s visibility makes awareness and proactive defense essential.

In response to these challenges, UCPath has strengthened internal processes, refined communication pathways, and deepened collaboration with Information Security and operational partners. A key improvement was transforming direct deposit fraud monitoring from a manual review to an automated solution, significantly strengthening controls and response time. What began as an urgent effort to understand new attack patterns has evolved into a coordinated approach to protecting employee information.

Earlier this year, Ochoa presented this work at HEUG #ProtectYourPay, highlighting how collaboration and process enhancements have improved UCPath’s ability to respond quickly and effectively. “Now, when something happens, we do not have to stop and think about the next step,” she said. “We simply react.”

She urges employees to stay alert to unexpected messages, verify unusual requests, and check URLs before clicking. She emphasizes the importance of recognizing subtle cues such as spelling errors, inconsistencies, or urgent language that may signal an impersonation attempt. "If something does not feel right, flag it." and "Ask questions; we are here to help. Do your research, verify everything, [and] remember that security is
everyone’s responsibility.”

Looking ahead, Ochoa is focused on continuous improvement and thoughtful innovation. She sees artificial intelligence as both a risk and an opportunity, and she is exploring how UCPath might use internal AI tools to streamline processes while maintaining access for employees. “We want to protect personal information,” she said, “but we also do not want to make it too challenging for employees to access their own data.”

Digital Innovation & Technology