Risk it for the Biscuit: Crunching the Numbers on Cyber Threats

The talk argues that many organizations measure cyber risk poorly, chasing headlines, zero-day news or CVSS scores instead of the causes that actually drive incidents. The speaker points to human-driven mistakes as the most common root of breaches and cites recent high-profile intrusions where a missing second factor or a weak account-recovery process made the difference.

The middle section covers the building blocks of a risk program: a complete asset inventory, layered data flow diagrams with labelled trust boundaries, and threat models built by repeatedly asking what is being built, what can go wrong and how it is handled. The speaker separates vulnerabilities from risks, since a risk exists only when a threat meets a weakness, and urges impact to be described in business terms such as lost revenue rather than offline servers. Mitigations go into a risk tracker with owner, impact, mitigation and review date, and accepted risk should be signed off by an executive with authority to own it.

The closing message is to stay focused on the most likely and most impactful risks instead of reacting to every new zero-day, because chasing the latest issue can leave larger gaps open. In the Q&A, the advice for requirements that teams keep deprioritizing was to escalate through executive levels and bring in legal teams, who can frame obligations in terms leadership understands.