Lucas Hathaway

Lucas Hathaway has 10+ years of experience in information security. He is the Chief Revenue Officer at Rivial Data Security. He has worked with Rivial clients for years leading the consulting team and now leads the growth team with a focus on client success ensuring that Rivial’s platform exceeds client expectations.

6 min read

NIST AI RMF for Financial Institutions: A Complete Guide

Lucas Hathaway: 14 Oct 2026

Financial institutions are adopting AI faster than they are governing it, and the request we now hear on calls is specific: "we need a credible AI governance framework, and we think it is the NIST AI RMF. Where do we start?" Boards are asking for a...

8 min read

How to Review a SOC 2 Report in Minutes, Not Hours

Lucas Hathaway: 26 Aug 2026

A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a...

8 min read

How to Write a Cyber Risk Appetite Statement

Lucas Hathaway: 20 Aug 2026

For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that...

8 min read

Shadow AI: A Guide to Finding the AI Already Inside Your Institution

Lucas Hathaway: 12 Aug 2026

A security officer at a credit union described their AI inventory to us like this: they went through the exercise, came out the other side with only...

8 min read

Every Vendor Has an AI Feature. Here's How to Assess It

Lucas Hathaway: 05 Aug 2026

A risk leader at a large financial institution said something on a call this year that we have heard some version of at almost every institution...

8 min read

How to Build a Cybersecurity Risk Register

Lucas Hathaway: 24 Jul 2026

For CISOs, IT risk leaders, compliance officers, and vCISOs, a cybersecurity risk register is the single source of truth that turns scattered...

5 min read

Quantitative vs Qualitative Cyber Risk Assessment: What Is the Difference?

Lucas Hathaway: 22 Jul 2026

Quick answer: A qualitative cyber risk assessment rates risk with labels like high, medium, and low, often on a color-coded heat map. A quantitative...

7 min read

AI Governance and AI Risk Management: A Complete Guide for 2026

Lucas Hathaway: 01 Jul 2026

Quick answer: AI governance is the set of policies, owners, and controls that decide how your organization adopts and runs AI. AI risk management is...

6 min read

How to Build an AI Acceptable Use Policy

Lucas Hathaway: 26 Jun 2026

For CISOs, IT risk leaders, compliance teams, and privacy and audit stakeholders, an AI acceptable use policy is fast becoming the line between...

8 min read

Vendor Due Diligence Checklist for Financial Institutions

Lucas Hathaway: 30 May 2026

For CISOs, risk leaders, compliance teams, and internal audit stakeholders at credit unions and community banks, vendor due diligence is one of the...

1 2 3 4 5 Next