Rivial Security Blog

The most common objection to cyber risk quantification does not come from boards. It comes from security leaders, and it goes like this: the number is only as good as the inputs, the inputs are guesses, so the dollar figure is just a g...

You have three proposals on your desk and the numbers are thousands of dollars apart for what each vendor calls the same thing: an IT risk assessment. Your CFO wants to know why you would not just take the cheapest one. This post gives you the honest ...

A security manager at a credit union told us recently that vendor security reviews are the bane of his existence. Another opened a call by saying a 52 page SOC report had landed in his inbox 45 minutes earlier and he had no idea when he would get...

For CISOs, IT risk leaders, compliance officers, and the board committees they report to, a cyber risk appetite statement is the document that decides which risks your organization will accept, which it will trea...

A security officer at a credit union told me that in his entire time at the institution, they had never once talked about risk in numbers. Colors, ratings, adjectives, yes. Numbers, no. Another told me she wants to move toward quantifica...