Who owns a technology-related business risk when revenue, operations, customer trust or regulatory standing are at stake?
In this episode of Business of Cybersecurity, I speak with Kayne McGladrey, a two-time CISO, independent fractional and virtual CISO, Senior Member of IEEE, and author of Cyber Risk Is a Myth: A Business Approach to Integrated Risk Management.
Kayne argues that calling something a cyber risk can create distance between the people who understand the technology and the people who own the business outcome. When the CISO is expected to accept a risk attached to someone else’s profit and loss statement, accountability becomes blurred and business leaders may make decisions without seeing the security dependencies beneath them.
We discuss how companies can replace technical severity scores and vulnerability counts with a shared language based on financial exposure, operations, reputation and regulatory impact. Kayne explains why each entry in a risk register should have a named business owner, while the security team identifies, quantifies, translates and monitors the exposure.
The conversation also covers the difference between documenting risk and using it to guide investment. A useful risk register should help executives compare exposure across business areas, connect controls to expected outcomes and track residual risk over time. This reframes the budget conversation from how much security costs to how much risk an investment reduces.
Kayne also explains why clean audits, insurance policies and written controls do not prove that a company can recover from an incident. Tabletop exercises, technical recovery tests and rehearsed decision paths provide stronger evidence of readiness. For board members, he offers practical questions about ownership, integrated reporting, business metrics and cross-functional reviews after incidents.
What evidence would show that cybersecurity is part of enterprise risk management in your organization, rather than a separate technical function? Listen to the conversation and share your thoughts with me.