Grey rhinos, black swans, and the kidnapping of Nancy Guthrie: What Corporate America still gets wrong about risk

When Savannah Guthrie’s 84-year-old mother was abducted in Arizona earlier this year, the FBI issued an unusual warning: in the age of AI, even a proof-of-life video can’t be trusted. A kidnapper now needs little more than a Linked In photo and a voicemail to manufacture a convincing deepfake. The old rules of crisis response no longer apply. It was, said Sid Kosaraju, president of global security firm Crisis24, exactly the kind of threat corporations have been slow to take seriously. A hush came over the room at the Fortune COO Summit in Scottsdale as Kosaraju described the actual threat landscape that most people would rather not think about. Two years into his role, he said, he asked his own security team to run a cyber assessment. He considered himself well-protected. But his team — ethical hackers — were able to pinpoint the location of his 12-year-old daughter in two-hour increments, every day, simply by accessing her school’s website and her tennis club’s schedule. She doesn’t even own a smartphone. “They could get into the school website. They could get into the tennis club website and pinpoint.” Usually what happens, Kosaraju explained, is that threat actors target children and elderly parents. “Sorry to say here right in this state of Arizona, we have the Guthrie incident.” These are things that the industry is wrestling with right now, he said. “It’s not just the principal. It’s the families that you have to protect against.” The Nancy Guthrie case was, he added, what the industry calls a “grey rhino” — a massive, visible, charging threat that most of us have been staring at for years and chose not to act on. It’s not a “black swan,” the term popularized by Nassim Taleb for unknowable, unpredictable catastrophes. A grey rhino: obvious in retrospect, ignored in the moment. That distinction, argued Kosaraju and Kroll CEO Jacob Silverman, in conversatio