The Top 10 Risk Management Mistakes CISOs Still Make

Josh Sokol, founder of SimpleRisk, opens with an airline story about turbulence: it is expected, and a crash is preventable. He argues that risk programs usually fail not for lack of information but because of how they are run. He organizes the talk into three groups: strategic blind spots, operational missteps, and culture and communication problems. Along the way he polls the audience on which problems they recognize.

The strategic section covers one-time risk assessments that go stale between review cycles, weak executive alignment when risk is not tied to business outcomes, and the absence of a defined risk appetite, which leaves decisions inconsistent. The operational section covers siloed ownership, where different teams track the same risk separately, and both over-engineered and under-engineered controls. It also covers risks that are not linked to the controls meant to address them, with a DevSecOps example of threat models and pipeline checks that never connect. The culture section recounts a critical vulnerability escalation from his time at National Instruments and argues for continuous horizon scanning, quantifying risk in financial or operational terms, and tailoring messages to executive audiences.

He closes by asking attendees to find the blind spots and unlinked controls in their own programs and to fix one or two of them that week. In the closing discussion he suggests framing security work around non-security benefits such as faster onboarding and reduced pipeline friction, which he says has produced measurable savings for organizations.