Security risks from upper management