CSPAD
DOMAIN 1 OF 8

Security & Risk Management — Strategic Lessons from the Field

How governance, risk, and compliance are evolving in 2026 — and what cybersecurity strategists are learning about board-level alignment, regulatory pressure, and risk that actually moves the needle.

Ishmael Chibvuri — Cybersecurity StrategistStrategic perspective by Ishmael Chibvuri, CISM · updated just now

Risk management has moved out of the back office. In every engagement I've been part of over the last eighteen months, the conversation that used to happen in the audit committee now happens in the boardroom — and it happens in dollars, not in heat-map colors. That shift is real, and it changes what good looks like for a security program.

What's shifting right now

The three forces I'm tracking most closely:

  1. Material risk disclosure — SEC and equivalent regimes are forcing public companies to assess and disclose cyber incidents on tight clocks. The downstream effect is that every program now needs a defensible materiality framework, not just public companies. Vendors and partners are inheriting the same standard.
  2. AI risk surfacing inside enterprise risk registers — the gap between "we use AI somewhere" and "we govern AI as a risk class" closed faster than most boards expected. NIST AI RMF and the EU AI Act have given GRC teams a vocabulary; what's missing is the operational telemetry.
  3. Third-party concentration risk — single-provider outages and supply-chain compromises (think mid-tier SaaS, identity providers, CDN) have moved concentration risk from a footnote to a top-five concern.

What keeps proving true

  • A risk you cannot quantify is a risk you cannot prioritize. Qualitative ratings inflate over time. Move to ranges (FAIR-style) even if the inputs are rough.
  • Compliance is a floor, not a ceiling. Programs that optimize for the audit collect findings; programs that optimize for resilience collect avoided findings.
  • The board doesn't need more dashboards. They need a story. Three numbers, one trend, one decision.

Below is the live wire across the domain — governance moves, regulatory shifts, and risk events that change the calculation.

// LIVE FEED

Latest from across the industry

30 items · 5 sources
SecurityWeek3h ago

Dragos Acquires xIoT Security Firm Phosphorus

Dragos said customers will soon gain expanded asset visibility and integrated device intelligence, with automated remediation workflows and a unified platform experience to follow. The post Dragos Acquires xIoT Security…

CSO Online4h ago

Flowise’s MCP implementation can run ghost commands

Enterprises using the lightweight, open-source Flowise platform to power self-hosted AI workloads have a new near-max severity issue to worry about. Researchers at Obsidian Security have detailed a one-click remote code…

SecurityWeek6h ago

Recent Palo Alto Networks Vulnerability Exploited for Weeks

Hackers began exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS, four days after public disclosure. The post Recent Palo Alto Networks Vulnerability Exploited for Weeks appeared first on Se…

CSO Online9h ago

6 critical security gaps every CISO must address

CISOs acknowledge that no organization is completely safe, but many also admit their security measures aren’t where they’d like them to be. One-third of CISOs surveyed for Proofpoint’s 2025 Voice of the CISO Report said…

Schneier on Security2d ago

Friday Squid Blogging: Another Squid

Someone named “Squid” seems to be a “West Country legend.” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

SecurityWeek3d ago

MokN Raises $15 Million for Phish-Back Platform

MokN's platform deploys realistic decoy access points to lure attackers into revealing compromised credentials, enabling organizations to respond before abuse occurs. The post MokN Raises $15 Million for Phish-Back Plat…

Schneier on Security3d ago

Chilling Effects

Younger Americans have soured on the second Donald Trump presidency, but they are not protesting it. Despite an unpopular Iran war and an even more unpopular Trump administration, college campus protests nationwide have…

CSO Online3d ago

Cybersecurity trends in SEC filings

In 2023, the Securities and Exchange Commission (SEC) required public companies to include a new section in their 10-K annual filings that is devoted to cybersecurity. This section is meant to address “cybersecurity ris…