Take a Risk

The talk argues that information security risk management is often skipped or done at a level that neither management nor security teams can use. Done well, it shapes budget requests and gives leaders a common yardstick for comparing cyber issues with financial, safety and other business risks. The speaker places risk work across three levels: organisation, business process and information system.

Next comes a look at how security risk functions are organised, from a central risk team that treats security as one category among equals to separate IT registers that rarely reach executives. A very short risk register suggests the exercise is a formality, while a very long list of scanner findings usually has no link to business impact. Sample risks show the difference: a vague one scored by gut feel, a hyper-technical one scored from a CVSS number, and a rewritten version that names the event, its financial or operational effect, a likelihood, a control and a named owner. The talk then covers the four treatment options: avoid, transfer, reduce and accept.

The closing section argues that accepted risks still need monitoring and reassessment, that acceptance authority should scale with risk score, and that zero risk is unattainable at any sensible budget. The speaker's three takeaways are to define impact rather than vulnerabilities, to think in business terms, and to accept that some risk is acceptable.