CISOs at HR, payroll and workforce-software firms: Dayforce, Paylocity, Deltek

What the documents cover

Three companies appear in the source material, and they differ in kind. Dayforce published two articles under the byline of its Chief Information Security Officer, Colin Anderson. Deltek published an article by its CISO, Becca Harness, dated October 30, 2024. Paylocity's leadership page lists a CISO by name and title but includes no statement from that person. This guide therefore describes what the two published CISO voices say, and what the Paylocity page shows.

Dayforce: payroll diversion fraud

The Dayforce article is dated August 30, 2023 and is described as an explanation by the company's CISO. The page says the CISO "explains how this type of direct deposit scam works and shares tips for identifying and preventing it."

The article defines the fraud as a scheme where cyber criminals try to redirect an employee's paycheck to an unauthorized bank account, typically under their control. It says the scheme often starts with phishing emails that appear to come from senior leaders or HR representatives.

The article describes the sequence after a click. An employee may land on a fake website that looks like a legitimate company portal, and entering login details gives fraudsters access. The scammer then changes the employee's bank account details, and may try to modify or delete notification settings so the employee gets no alert.

The article frames Dayforce's reason for publishing as a duty. It says that as human capital management leaders, "we feel it's our duty" to help keep payroll, HR and business practitioners aware of threats.

Dayforce: the controls it names

The article lists warning signs: an unexpected email from HR or senior personnel asking for payroll changes, pressure to act quickly or confidentially, and requests for information HR or payroll should already have. It adds mechanical clues such as generic greetings, spelling mistakes and sender addresses that do not match the sender's name.

On prevention, the article calls employee education "one of the most important things organizations can do." It also names organizational controls:

• Multiple parties, including the payroll administrator, should verify and approve any request to change direct deposit information.
• Multifactor authentication, which the article calls an effective way to prevent all kinds of fraud, including direct deposit scams.
• Internal alerts for any changes in bank account details.

The article also warns about password reuse, saying a single compromised password can lead to unauthorized access to other accounts.

Dayforce: impersonation and HR credential compromise

The second Dayforce article is dated June 12, 2025 and carries the same CISO byline. It says HR is experiencing a rise in social engineering calls, many involving fraudsters impersonating legitimate employees to trick HR teams into changing sensitive information.

It gives two examples. In the first, a caller impersonating an employee persuades an HR team member to update payroll information, which could compromise an employee's payroll or personal identification data. The article adds that software can create a more realistic imitation of a voice, known as a deep fake, especially for executives and employees with publicly available talks, podcasts or interviews.

In the second, callers claim to be from IT and offer to update a system or apply a patch, with the goal of getting employees to share system credentials, including for HR systems.

The article's list for HR professionals includes unique security questions for authenticating employees making important changes such as payroll updates, training HR teams to authenticate employees properly, and training all employees to spot phishing, vishing and smishing. It also advises speaking to the HR system administrator about enabling multi-factor authentication, "which helps reduce the impact of compromised credentials."

Deltek: customer data and a broader role

Deltek's CISO writes in the first person and describes the role more broadly than fraud. She notes that the first CISO positions appeared in the late 1990s and that the pace of change remains relentless.

On customer data, she writes that Deltek's product security roadmap shows "we take our customers' data seriously." She says Deltek supports customers by implementing and monitoring controls consistent with various laws, regulations and industry standards.

On threats, she says ransomware was the primary concern a few years ago, and that nation-state actors and sophisticated cybercriminals are now increasingly targeting sensitive information. She describes protecting identity, and ensuring that devices and users accessing information are legitimate, as a complex challenge, and calls zero trust a critical strategy for mature organizations.

She also says AI-generated threats such as advanced phishing and deepfakes add complexity, and that Deltek sees AI as "a key collaborator" in detecting and responding to threats.

Her advice to CISOs is about people: implement security in a way that encourages people to engage with the security program.

Paylocity: what the page shows

The Paylocity leadership page lists Art Chaisiriwatanasai with the title Chief Information Security Officer, alongside other executives including the CFO, the Senior Vice President of Product & Technology and a Vice President of IT and Enterprise Applications. The page contains no description of the CISO's responsibilities, and no statement on customer data or fraud. A comparison of how Paylocity frames the role cannot be made from this document.

Common threads across the two CISO voices

Both Dayforce articles and the Deltek article name phishing-related threats, and both companies mention deepfakes. Dayforce ties the threat to specific payroll and HR workflows and recommends controls such as MFA and approval steps. Deltek speaks at the program level: continuous improvement, zero trust, regulatory alignment and customer data commitments. Neither document gives incident figures or describes a breach at the company.