IT told the committee that "Identity (user accounts) remains the primary attack vector" and outlined steps including MFA tokens and an inbound email platform to reduce credential attacks and AI‑enhanced phishing risk.