This conversation has been edited for length, clarity and continuity. It was also excerpted in the Forbes CFO newsletter. A longer version is available here.

What do you see as some of the biggest hazards in a company in terms of safeguarding their data?

Kumar: The short answer, the absolute biggest risk is lack of shared accountability, which arises from lack of shared visibility. But let me elaborate a little bit. We need to view the risk in the context of the fast-evolving threat landscape. So you’ve got different data assets—whether it’s financial data, strategic data, client data, employee data. Unfortunately, most organizations are operating in silos. That means CFOs do not really have full visibility on where the data lies, and they have not really incorporated protecting them or taking any cybersecurity measures as part of their financial risk management.

Because of this disconnect, and generally how the CIOs or CTOs and CFOs collaborate, this leads to the presence and increasing expansion of shadow data: Nobody knows where the data is or what kind of data it is, or how it can be tracked back to some of the crown jewels. The increasing diversity of data assets; the emerging sophistication of hackers; and the lack of proactive, collaborative, culturally driven operating models between the CTOs and [CFOs], they all contribute to the explosion in the risk exposure.

When you look at cybersecurity threats, they’re always changing, with bad actors finding new ways to try to get into data, get into systems, that sort of thing. How does collaboration help, not just for now but for the future?

It’s always a game of who stays one step ahead of the other. If we are going to take them in isolation and one by one, there will be cases where the attackers will win and the defenders will lose. Where there is joint accountability, when parties—especially senior leaders like CTOs and CFOs—have a good understanding of the threat landscape, they also understand where the data resides, what is the risk exposure, it automatically heightens their preparedness and approach toward proactively putting in place a set of mechanisms to guard that data.

This automatically reduces your threat exposure by a lot. Some of these provisions can be technology-based: You could have a NIST-based security assessment, you could have penetration testing, you could have parameter scanning, you could have advanced edge computing-based security. Some of these are technology, some of these have to do with human capital, where there’s sponsorship and initiative to build that knowledge. A lot of these hackers find humans as the most vulnerable and easy way to hack the system, so enabling that human capital to be a robust wall in front of these attacks is important.

Third is the general culture of being cybersecurity aware, and practice simple things, like locking computers when you’re walking away even two minutes away from your desk, do not use public WiFi if you are working on sensitive strategic data files. A culture where parties see the leaders leading by example, and then they emulate it.

What advice would you give to a CIO to start working with their CFO?

The CIOs have to step up from playing an operational role to a more strategic role. Instead of just putting down the nails and the locks around the place and securing it, they have to elevate the articulation of the problem at the strategic level where it can be communicated to the board: What is the overall risk impact? They almost have to take on a risk manager role from a cybersecurity perspective, and not just be the operator of those security mechanisms.

We need to be able to tell a good story: If you don’t do this, these are the things that could go wrong, and this is going to cost you in the dollar terms, and have that communication with the board. This is part of stepping up and expanding their point of view from being just a technology or internal service provider to a stakeholder in the business. It’s not just about, ‘Tell me your data and I’ll put it in a vault and secure it,’ but ‘Help me understand your business and let me be a partner in delivering the business outcome that you’re intending [for] your shareholders, the board and other stakeholders.’