If you spend enough time in a benefit office, you notice something. The work that matters most rarely feels dramatic. It’s answering participant calls, reconciling payments, reviewing reports, and making sure details are right.

Cyberthreats have learned how to look exactly like that kind of work. They show up as a routine email, a familiar vendor request, a login that seems harmless, or a new tool that promises efficiency. Nothing about it feels unusual, and that’s what makes it effective.

Benefit offices hold more than money. You hold the lifetime identity records of working families — Social Security numbers, beneficiary elections, health information, banking details. That information represents trust built over decades.

Protecting plan assets now includes protecting the systems and data behind them. Cyber risk no longer sits on the edge of the organization; it runs through everyday operations — how money moves, how email is secured, how vendors connect, how technology is governed.

Most trustees did not sign up to become cybersecurity experts. But fiduciary responsibility does not require technical mastery. It requires oversight. It requires asking good questions. It requires making sure protections are intentional, documented, and reviewed.

In many ways, this is not new. Benefit offices already operate with discipline around investments and compliance. The same mindset applies here: structure, verification, and governance.

As you read this issue, consider a simple question: If something unexpected occurred tomorrow, could we demonstrate that we approached cyber-risk with the same care we apply to everything else entrusted to us?

That question isn’t about fear. It’s about leadership. Strong unions have always been built on responsibility. Extending that responsibility into the digital environment is simply the next chapter.