Mortgage
The Devastating Consequences of Leadership Absence
Articles by: Richey May, May 20, 2025
December 7, 1941. Pearl Harbor.
Within just 90 minutes, the United States lost 2,403 lives, 188 aircraft, and 19 naval vessels including five battleships. Military leadership was in disarray, communication channels failed, and critical intelligence warnings went unheeded. The absence of unified, strategic leadership had created catastrophic vulnerability.
Eight days later, Admiral Chester Nimitz assumed command of the crippled U.S. Pacific Fleet. What followed was one of history’s most remarkable defensive turnarounds.
The leadership lessons from Admiral Nimitz’s response to the Pearl Harbor tragedy offer valuable insights for mortgage banks facing their own security challenges. Just as Nimitz had to rapidly assess vulnerabilities and devise strategic defenses after a devastating attack, businesses must build robust cybersecurity systems before threats materialize.
The takeaway for mortgage banks? Strategic leadership drives design and management of mature cybersecurity programs … programs that anticipate threats rather than simply reacting to them. In several recent cases across various industries, organizations with inadequate security leadership suffered significant breaches affecting customer data, resulting in substantial recovery costs and litigation expenses that exceeded their insurance coverage.
Like the Pacific Fleet before Nimitz’s arrival, mortgage banks without strategic security leadership may discover vulnerabilities only after an incident occurs. By then, financial damage can be substantial, client trust compromised, and lending operations disrupted while teams work to rebuild their defenses.
Three Elements of Nimitz-Level Security Leadership for Mortgage Banks
When Nimitz took command, the Pacific Fleet was in disarray. Its remaining ships were scattered, morale was shattered, and Japanese forces seemed unstoppable. Yet within six months, he orchestrated the decisive American victory at Midway, considered the turning point of the Pacific War.
How did he accomplish this extraordinary turnaround? The same three leadership elements that define effective C-level leadership for mortgage banks today:
1. Decisive Leadership Through Deep Knowledge
Nimitz brought over 40 years of naval experience to his role, including submarine warfare expertise, shipyard command, and formal education at the Naval War College. This panoramic understanding allowed him to make strategic decisions while others remained paralyzed by the uncertainty that accompanies a lack of perspective.
Similarly, effective cybersecurity leadership for mortgage banks requires specialized knowledge across multiple domains: not just technical security, but mortgage-specific regulations like MORA, Fannie Mae and Freddie Mac requirements, Ginnie Mae guidelines, and NYDFS cybersecurity regulations. This industry-specific expertise enables decisive action rather than reactive panic when faced with attacks targeting loan processes, borrower data, or payment systems.
The mortgage industry is uniquely targeted due to its wealth of borrower information. From tax returns and Social Security numbers to bank statements and employment records, mortgage lenders possess the most comprehensive financial profiles of consumers, making them prime targets for data theft. Security leadership with mortgage experience understands these specific risks and how to mitigate them.
2. Innovative Adaptation to Emerging Threats
While his contemporaries clung to pre-war naval strategies centered around battleships, Nimitz recognized that aircraft carriers had fundamentally changed warfare. He reorganized the Pacific Fleet around this innovative approach, leveraging these assets against conventional Japanese tactics.
The mortgage cybersecurity landscape changes just as rapidly. Traditional defenses built around perimeter security are increasingly ineffective against modern threats targeting mortgage banks. As industry research has shown¹, vishing attacks skyrocketed 442% in the second half of 2024, with attackers specifically targeting mortgage loan officers through sophisticated social engineering campaigns.
Effective security leadership in the mortgage space must adapt to these emerging threats. For example, where traditional security focused on preventing malware, modern mortgage security must address “living off the land” attacks and advanced persistent threats where adversaries use legitimate tools like Microsoft Quick Assist to gain remote access to mortgage processors’ systems.
3. Strategic Presence and Resource Allocation
Perhaps Nimitz’s most important leadership quality was his ability to maintain strategic presence without being a progress-stifling micromanager. Despite commanding operations across the entire Pacific Ocean (a theater spanning millions of square miles), Nimitz established effective command structures that enabled coordinated action.
His “island hopping” strategy exemplifies this approach. Rather than attempting to recapture every Japanese-held position, Nimitz concentrated resources on strategically critical targets while bypassing heavily fortified but less essential locations.
This strategic prioritization mirrors one of the most challenging aspects of mortgage cybersecurity: resource allocation. With compressed margins and increasing operational costs, mortgage banks must decide where to focus their security investments for maximum impact.
For mortgage lenders, not all systems carry equal risk. The loan origination system, wire transfer processes, and customer data repositories require robust protection, while other systems may need only baseline controls. Without strategic leadership, banks may implement security measures haphazardly, over-defending (and over-investing) in areas that need only basic protection while leaving gapping vulnerabilities in their most sensitive systems.
The vCISO Solution: Nimitz-Level Leadership Without the Admiral’s Salary
Most mortgage banks recognize the need for strategic security leadership but struggle with the cost and availability of qualified professionals. A full-time CISO with mortgage industry experience requires an investment of $565,000 annually for financial services firms according to IANS research²; this is prohibitive for many lenders, especially independent mortgage banks and community lenders facing margin pressures.
This is where the virtual CISO (vCISO) model provides compelling value for the mortgage industry. A vCISO delivers executive-level security leadership on a fractional basis, providing the benefits of strategic direction without the full-time cost.
At Richey May, our vCISO service brings the three Nimitz leadership elements to mortgage banks of all sizes:
1. Deep Knowledge Through Mortgage-Specific Experience
Unlike Nimitz who had to rely primarily on his personal experience, our vCISO service combines specialized cybersecurity expertise with a deep understanding of the unique challenges confronting mortgage banks. Working with a broad portfolio of mortgage bank clients has equipped our team with invaluable insights into the specific security needs and regulatory requirements of the industry.
This means your mortgage bank benefits not just from general security knowledge, but from lessons learned across hundreds of mortgage security programs and incident responses. Our vCISOs maintain current certifications in mortgage-relevant frameworks including NYDFS cybersecurity regulations, CCPA, and emerging state privacy laws.
2. Innovation Through Mortgage Industry Insights
Much like Nimitz’s ability to recognize the strategic shift from battleships to carriers, our vCISOs bring innovative approaches informed by their work across the mortgage ecosystem. This sector-specific insight helps identify emerging threats before they become widespread.
For example, when we observed early social engineering attacks targeting mortgage loan officers, we developed proactive controls and training programs specifically designed for mortgage operations. By understanding how loan officers work and communicate, we created security measures that protect without impeding productivity.
3. Strategic Presence Through Flexible Engagement
Our vCISO service establishes the strategic security framework and governance model appropriate for your mortgage bank’s size, business model, and risk profile. Like Nimitz’s command structure, this approach ensures consistent security direction while empowering your internal team to execute tactically.
For mortgage banks, this means having security leadership that understands the critical timing of month-end closings, the impact of rate fluctuations on volume, and the importance of maintaining service levels while implementing security controls. Our vCISOs develop strategies that protect your institution without disrupting loan operations.
Beyond Pearl Harbor: Preparing Rather Than Repairing
The attack on Pearl Harbor was a catastrophic surprise that transformed American military strategy. Today, mortgage banks have the opportunity to implement strategic security leadership before experiencing a significant cybersecurity incident.
By engaging a vCISO service, mortgage banks can establish a robust standard of cyber resilience across their organization through:
- Security strategies aligned with mortgage-specific business processes
- Governance frameworks that ensure regulatory compliance
- Incident response plans that minimize disruption to loan operations
- Security awareness among loan officers, processors, and closers
- Secure workflows for handling borrower data
- Board and executive support for critical security investments
The Nimitz doctrine of decisive knowledge-based leadership, innovative adaptation, and strategic presence remains as relevant in today’s mortgage cybersecurity landscape as it was in the Pacific theater of WWII. These leadership qualities form the foundation of true cyber resilience for modern mortgage lenders.
The Richey May vCISO Difference for Mortgage Banks
Unlike Nimitz, who had to rebuild the Pacific Fleet while simultaneously defending against an advancing enemy, your mortgage bank can implement strategic security leadership before a crisis strikes.
Richey May’s vCISO service provides the strategic security leadership your mortgage business needs at a fraction of the cost of a full-time CISO. Our vCISOs bring deep mortgage industry knowledge, innovative thinking, and strategic presence to your security program, ensuring that you’re resilient against today’s evolving threats.
Don’t wait until you face a significant security incident. Position your organization for success with the right strategic leadership today.
Join Us: Develop Your Strategic Cybersecurity Command
Join cybersecurity experts from Richey May and Arctic Wolf on June 26 to learn more about “Reaching Cyber Resilience: The Importance of Training and Testing.”
Unlock the secret to true cyber resilience … because having a plan isn’t enough if you haven’t put it to the test. Most organizations believe they’re prepared for cyber incidents, but without hands-on training and real-world exercises, critical gaps remain undetected until it’s too late.
During this essential session, you’ll learn:
- How to establish your organization’s cybersecurity “Command Center”
- Proven frameworks for critical decision-making during security incidents
- Strategies for building a security culture that works when it matters most
- Actionable insights on employee training from a guest expert at Arctic Wolf
Don’t wait until your organization faces its own “decisive battle” moment to discover gaps in your security leadership. Just as Admiral Nimitz understood at Midway, when it comes to protecting your critical assets and ensuring business continuity, preparation and strategic leadership determine the outcome.
¹ Crowdstrike Global Threats 2025.
² IANS research on CISO compensation in financial services, 2024.