The Security Practitioner's Guide to Going from "No" to "Whoa"

The talk opens with what the speaker calls "Atlas syndrome": security staff carry every alert, scan result and pentest finding as a personal burden while leadership keeps deferring fixes. He cites industry alert volumes and recalls a backlog of more than a hundred thousand untriaged scanner findings from his own time running a program. His central point is that practitioners find and communicate risk, but accepting it belongs to the business.

The middle section lays out a practical approach. He recommends anchoring work to a common control framework, running a maturity exercise against a standard such as the NIST CSF to expose gaps, and turning those gaps into a roadmap that management can approve and fund. He argues that severity scores need context, that every employee should be able to log a risk, and that risks should route to management levels by severity for review and sign-off. He compares spreadsheets with a dedicated database-backed platform on scale, joins across data sets and maintenance overhead, and notes that his open-source GRC tool is one option among others.

The close covers building buy-in. He suggests starting with managers rather than teams, framing open risks as problems that need visibility, and reassuring individual contributors that reporting an issue leads to a decision rather than blame. The takeaway is that a "no" is a point to continue from, where partial mitigation, risk transfer or added monitoring can still reduce exposure while leadership owns the choice.