5 min read
Randy Lindberg: 09 Sep 2026
The most common objection to cyber risk quantification does not come from boards. It comes from security leaders, and it goes like this: the number is only as good as the inputs, the inputs are guesses, so the dollar figure is just a guess wearing a...
Read More
4 min read
Randy Lindberg: 02 Sep 2026
You have three proposals on your desk and the numbers are thousands of dollars apart for what each vendor calls the same thing: an IT risk...
8 min read
Lucas Hathaway: 26 Aug 2026
A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a...
8 min read
Lucas Hathaway: 20 Aug 2026
For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that...
8 min read
Randy Lindberg: 19 Aug 2026
A security officer at a credit union told me that in his entire time at the institution, they had never once talked about risk in numbers. Colors,...
8 min read
Lucas Hathaway: 12 Aug 2026
A security officer at a credit union described their AI inventory to us like this: they went through the exercise, came out the other side with only...
8 min read
Lucas Hathaway: 05 Aug 2026
A risk leader at a large financial institution said something on a call this year that we have heard some version of at almost every institution...
8 min read
Lucas Hathaway: 24 Jul 2026
For CISOs, IT risk leaders, compliance officers, and vCISOs, a cybersecurity risk register is the single source of truth that turns scattered...
5 min read
Lucas Hathaway: 22 Jul 2026
Quick answer: A qualitative cyber risk assessment rates risk with labels like high, medium, and low, often on a color-coded heat map. A quantitative...
9 min read
Randy Lindberg: 08 Jul 2026
Quick answer: Choose a vCISO who acts as a strategic security leader, not an operator. The right one owns risk, governance, board reporting, and the...
