Much has changed since the early 20th century bank robber Willie Sutton, when asked why he chose his targets, reportedly said, “Because that's where the money is.” Criminals are now using tools Sutton couldn't have dreamed of, but their philosophy in choosing targets remains pretty true to his.

Many attacks are now perpetrated online, alarming growth in volume and sophistication over the past two years. Equally distressing is the range of perpetrators, from conventional hackers and disgruntled employees to well-funded nation-states, terrorist organizations, and criminal groups. Their top target in many attacks: corporate treasury.

That's where the corporate money is. But some hackers that target treasury have more in their sights than direct theft of company funds. Treasury systems are repositories of sensitive data that can be stolen. Crucial financial systems also can be shut down, either for ransom or to promote a geopolitical agenda. Aside from the financial costs of these disruptions, companies confront the risk of serious reputational damage, which may have a lingering business impact.