Lessons - The Man Who Protects Millions of Dollars Online Every Day | John Downey - CISO at GoFundMe (Fmr PayPal)

The most dangerous cybersecurity threats aren't sophisticated hacks—they're simple human errors exploited by financially motivated attackers who target unlocked 'car doors' like weak passwords, unpatched systems, and unencrypted laptops. John Downey, former CISO at PayPal and current CISO at GoFundMe, reveals that over 80% of successful breaches begin with stolen credentials, not complex intrusions. He emphasizes that the real vulnerability isn’t technology—it’s people, especially in nonprofits and small businesses that lack dedicated IT teams. The solution? A culture of psychological safety where employees feel empowered to report suspicious activity without fear of punishment. Drawing from the SolarWinds breach, Downey highlights how one alert employee’s courage—triggered by a strange MFA reset email—exposed a massive supply-chain attack. This moment underscores a critical truth: the strongest security layer isn’t firewalls or encryption—it’s a 'human firewall' built on trust, empathy, and blameless postmortems. When leaders respond to mistakes with support instead of reprimand, they create an environment where threats are surfaced early, not hidden.