4 min read
Randy Lindberg: 30 Sep 2026
Somewhere in your board policy there is a sentence like this: "The credit union will not accept cyber risk exceeding 3 percent of net worth." The board approved it, the examiner saw it, and it has influenced exactly zero security decisions since....
Read More
5 min read
Randy Lindberg: 23 Sep 2026
Pull up your current risk assessment and look at what the rows actually are. For most institutions, they are threats: ransomware, phishing, insider...
5 min read
Randy Lindberg: 09 Sep 2026
The most common objection to cyber risk quantification does not come from boards. It comes from security leaders, and it goes like this: the number...
4 min read
Randy Lindberg: 02 Sep 2026
You have three proposals on your desk and the numbers are thousands of dollars apart for what each vendor calls the same thing: an IT risk...
8 min read
Lucas Hathaway: 26 Aug 2026
A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a...
8 min read
Lucas Hathaway: 20 Aug 2026
For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that...
8 min read
Randy Lindberg: 19 Aug 2026
A security officer at a credit union told me that in his entire time at the institution, they had never once talked about risk in numbers. Colors,...
8 min read
Lucas Hathaway: 12 Aug 2026
A security officer at a credit union described their AI inventory to us like this: they went through the exercise, came out the other side with only...
8 min read
Lucas Hathaway: 05 Aug 2026
A risk leader at a large financial institution said something on a call this year that we have heard some version of at almost every institution...
8 min read
Lucas Hathaway: 24 Jul 2026
For CISOs, IT risk leaders, compliance officers, and vCISOs, a cybersecurity risk register is the single source of truth that turns scattered...
