For years, leadership pages were treated as harmless marketing that included a headshot, title and polished bio. It’s a marketing item that’s supposed to feel credible and human. And, it probably does.

‍

Here’s what most companies are getting wrong: Leadership pages shouldn’t only be a marketing decision; they’re also a security decision.

‍

Reconnaissance starts with a website

Attackers don't start with an attack. They start with research.

‍

Open-source intelligence (OSINT) lets an attacker build an organizational map using nothing but what's already public. A leadership page conveniently hands over:

• Who holds authority, controls budget, and owns security
• Reporting lines and who talks to whom
• What each executive looks like and where they've worked
• Exactly how their name and title should appear in a convincing message

Layer in LinkedIn, press releases, conference bios, and breached data, and an attacker has a detailed org chart without ever touching your network. Add in AI and the stakes increase. AI enables attackers to research targets, mimic writing styles, generate synthetic images, clone voices, and personalize attacks at scale.

‍

We’ve all been warned about threat actors impersonating executives via text and AI-generated voice. So, it should be no secret that publicly available photos are often used as source material. Based on that alone, it’s safe to say that a headshot isn't just a headshot anymore. And, the bio isn't storytelling. It's all context.

‍

“But everyone knows and it’s all publicly available.”

‍

Probably, but that’s not the point. We’re not saying that security is going to make this information undiscoverable. We’re also not saying that audiences shouldn’t know who’s behind your organization. It’s about recognizing there’s a real gap between information that can be found and information your company has organized, verified, and published. Why make it easier to access?

‍

We don’t believe your executives need to disappear. On our own About page, you won’t find names and headshots of our team. That’s intentional and designed to limit unnecessary exposure. Why? Because we’ve seen what an attacker can do with information published on a company website.

‍

Our recommendation is two-fold

First, consider what someone actually needs to know to trust your organization. Then publish only that.

‍

Second, encourage security and marketing to develop a partnership. Marketing is going to see adding more information to the website as achieving more credibility. Security teams see it as a risk. Neither is wrong, but there's an opportunity to work together on weighing the tradeoff.

‍

While you may not be able to eliminate public information about your organization, you can stop giving attackers the briefing deck.