Lucas Hathaway

Lucas Hathaway has 10+ years of experience in information security. He is the Chief Revenue Officer at Rivial Data Security. He has worked with Rivial clients for years leading the consulting team and now leads the growth team with a focus on client success ensuring that Rivial’s platform exceeds client expectations.

5 min read

How Many Systems Belong in Your IT Risk Assessment?

Lucas Hathaway: 05 Nov 2026

Somewhere in almost every risk assessment proposal, the same quiet negotiation happens. The list starts at 60 systems, someone winces at the price, and it gets trimmed to 40. Another institution insists 20 is plenty. A third is sure the answer is...

5 min read

Incident Response Playbook: When a Critical Vendor Gets Breached

Lucas Hathaway: 28 Oct 2026

If you work at a credit union, the last few months have made one thing hard to ignore: your next incident probably will not start on your network. It...

4 min read

Can Copilot Do Your Vendor Security Reviews? An Honest Answer

Lucas Hathaway: 21 Oct 2026

A risk leader at a financial institution told us on a call this year, plainly, that Copilot already gets his team about 80 percent of the way through...

6 min read

NIST AI RMF for Financial Institutions: A Complete Guide

Lucas Hathaway: 14 Oct 2026

Financial institutions are adopting AI faster than they are governing it, and the request we now hear on calls is specific: "we need a credible AI...

8 min read

How to Review a SOC 2 Report in Minutes, Not Hours

Lucas Hathaway: 26 Aug 2026

A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a...

8 min read

How to Write a Cyber Risk Appetite Statement

Lucas Hathaway: 20 Aug 2026

For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that...

8 min read

Shadow AI: A Guide to Finding the AI Already Inside Your Institution

Lucas Hathaway: 12 Aug 2026

A security officer at a credit union described their AI inventory to us like this: they went through the exercise, came out the other side with only...

8 min read

Every Vendor Has an AI Feature. Here's How to Assess It

Lucas Hathaway: 05 Aug 2026

A risk leader at a large financial institution said something on a call this year that we have heard some version of at almost every institution...

8 min read

How to Build a Cybersecurity Risk Register

Lucas Hathaway: 24 Jul 2026

For CISOs, IT risk leaders, compliance officers, and vCISOs, a cybersecurity risk register is the single source of truth that turns scattered...

5 min read

Quantitative vs Qualitative Cyber Risk Assessment: What Is the Difference?

Lucas Hathaway: 22 Jul 2026

Quick answer: A qualitative cyber risk assessment rates risk with labels like high, medium, and low, often on a color-coded heat map. A quantitative...

1 2 3 4 5 Next