.png?width=2400&height=1256&name=NIST%20AI%20RMF%20Featured%201200x628%20(1).png)
6 min read
Lucas Hathaway: 14 Oct 2026
Financial institutions are adopting AI faster than they are governing it, and the request we now hear on calls is specific: "we need a credible AI governance framework, and we think it is the NIST AI RMF. Where do we start?" Boards are asking for a...
Read More.png?width=2400&height=1256&name=Framework%20Comparison%20Featured%201200x628%20(1).png)
4 min read
Randy Lindberg: 07 Oct 2026
Every credit union security leader eventually asks the same question, usually right before an exam or right after a merger: which framework does the...
4 min read
Randy Lindberg: 30 Sep 2026
Somewhere in your board policy there is a sentence like this: "The credit union will not accept cyber risk exceeding 3 percent of net worth." The...
5 min read
Randy Lindberg: 23 Sep 2026
Pull up your current risk assessment and look at what the rows actually are. For most institutions, they are threats: ransomware, phishing, insider...
5 min read
Randy Lindberg: 09 Sep 2026
The most common objection to cyber risk quantification does not come from boards. It comes from security leaders, and it goes like this: the number...
4 min read
Randy Lindberg: 02 Sep 2026
You have three proposals on your desk and the numbers are thousands of dollars apart for what each vendor calls the same thing: an IT risk...
8 min read
Lucas Hathaway: 26 Aug 2026
A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a...
8 min read
Lucas Hathaway: 20 Aug 2026
For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that...
8 min read
Randy Lindberg: 19 Aug 2026
A security officer at a credit union told me that in his entire time at the institution, they had never once talked about risk in numbers. Colors,...
8 min read
Lucas Hathaway: 12 Aug 2026
A security officer at a credit union described their AI inventory to us like this: they went through the exercise, came out the other side with only...
