Cyber Risk Is a Myth and the Business Owns the Outcome

[00:00:00] AI agents are only as strong as the data that they're given. When provided with an outdated data set, your agents could end up doing more harm than good. But not with Denodo. With an AI data layer built within your platform, your agents are provided with real-time data changes. So with Denodo, your agents can finally make the right business decisions. Simply visit denodo.com to learn more.

[00:00:32] What happens when a company calls cyber risk a business risk, but still leaves every important decision within the security team? Well, my guest today is Cain McGladry. He's a two-time CISO, senior member of IEEE and author of a forthcoming book called Cyber Risk Is a Myth, a business approach to integrated risk management. And he's going to argue today that the label cyber

[00:01:02] risk can actually obscure the outcomes that are truly at stake here. And by that, we mean things like revenue, customer trust, operational continuity and regulatory standing. So today we're going to discuss why the business leader who owns an outcome should also own the related risk and explore how security teams can become trusted advisors and translators and what boards

[00:01:31] can ask to determine whether cyber security is a part of enterprise risk management or just keep them operating in a silo. And we will also examine how risk registers can influence budgets, why compliance paperwork does not prove resilience and how realistic exercises can expose some of the gaps things that are needed to make sure they're going to be able to do. And so, you know,

[00:01:58] and do they have the information and most importantly, authority to make the right decision? But don't think about that for too long. You can have a think after the episode because right now it's time for me to introduce you to my guest. So thank you for joining me on the show today. Can you tell everyone this thing a little about who you are and what you do? Thanks, Neil. I'm Cain McGladry. I am the author of the forthcoming book, Cyber Risk is a Myth. I'm a two-time CISO, Chief Information Security Officer,

[00:02:28] currently working as an independent fractional or virtual CISO. And finally, I'm a senior member of the IEEE. Awesome. Well, thank you for joining me today. And we've got a lot to talk about. And when we talk about cyber risk, I think people frequently say that they are cyber risks or business risks. No argument there, or maybe there is an argument, but why does that statement often collapse when senior

[00:02:54] leaders are asked what they should be doing differently on Monday morning? Well, here's the thing. Cyber risk is a business risk. It sounds great on a slide deck. Yeah. And it's technically true, and I feel like a lot of AI has been burping up that answer for about five years now, if LinkedIn's a fair barometer. But the moment you ask a senior leader, okay, so what do you do differently tomorrow? You get, you get silence and that silence really should tell us everything. And the reason it's

[00:03:20] falling apart is that most organizations, they've done the talking, but they haven't thought through what it means. They haven't done the building. They haven't made the, the, that statement real. Like we don't, we don't have a shared language security teams talking what I call vanity metrics, CBEs and CBS scores business leaders though. They talk about revenue or reputation or regulatory exposure. Nobody built the bridge between those vocabularies. And so when a CISO says, Oh, that's a

[00:03:46] critical vulnerability. The CFO just heard noise, not, not dollars. Second, our accountability is still split. Security owns this cyber risk business owns own business risk, but nobody owns the overlap. And the book that I wrote shows that the mature organizations have got clear shared accountability where business leaders are actually responsible for security risks in their areas, but most companies are not there yet. And finally, our decision-making processes are still broken. They haven't changed.

[00:04:14] If cyber risk was truly a business risk, security would be in the room during strategic planning, during budget allocation and at project approval, but it's not security shows up after a decision's been made. And it's asked to bolt on a control. So the statement falls apart because it's, it's like a bumper sticker that's on a car with no engine. And the fix isn't just saying like, let's repeat that slogan louder. Like everyone on LinkedIn does it's, we have to rebuild our governance. We have to create that shared vocabulary and we have to have those accountability

[00:04:44] structures. So on Monday morning, there's actually something different for leaders to do. And your book that you've mentioned there, you argue that cyber risk is a myth. So tell about everyone listening, what you mean by that and how does separating cyber risk from enterprise risk, how does that distort decision-making? Well, when I say cyber risk is a myth, I'm not saying that threats aren't real because of course they are. What I'm saying is that cyber risk is a standalone category. It doesn't exist. There's

[00:05:13] no magical bucket of risk that only lives in computers somehow and has nothing to do with your business. Every so-called cyber risk is really just a business risk that happens to involve some technology, but it's revenue at risk. It's customer trust at risk. It's operational continuity risk. It's your regulatory standing at risk. Those are, those are business outcomes. They're not an IT project. And the problem is when we call something a cyber risk, we give executives an excuse to delegate

[00:05:38] it entirely to the security team and wash their hands of it. And the book's framework talks about how that plays out. You get these separate risk registers, you get separate vocabularies, you get separate governance structures, you get separate budgets, security rights risks in frequently like technical jargon. Nobody else is going to read business leaders though. They make strategic decisions without understanding the security dependencies that are buried in them. And nobody's owning that, that overlap between the two, which is usually where the most dangerous

[00:06:07] risks tend to live in the book. I put together a decision authority matrix, basically a racy chart with something into extra bits of bolted on that helps people write this down. Cause in most organizations, you think about it, risk acceptance for security issues. It's the CISO, but the CISO, they don't own the business outcome. The business executive does. When you, when you separate cyber risk from enterprise risk, you end up with this weird situation of technical people making business

[00:06:34] risk decisions and business leaders basically flying blind on risks that they're going to be eventually accountable for through their profit and loss statement. That's the distortion with this fragmented, like ownership and language and decision-making across the exact same risk. We're doing it just because somebody put the word cyber as a prefix and it isn't helping any. And I think it was a few years ago, there was a lot of hype around the fact that the boardroom

[00:06:59] didn't see the value in cyber security, especially because it's something that might happen rather than will happen. But what have the recent court cases shown boards and executives about maybe personal accountability for weak cyber security governance? They quickly changed their tune when they were missing the headlines, right? You know, this is where a lot of people will talk about solar winds or they'll talk about the SEC security and exchange commission. No, no, we need to walk it back a little bit earlier and look at

[00:07:28] fireman's retirement system of St. Louis against Marriott and against their executives and directors in the Delaware court of chancery. And I remember this one I write about in the book after the Starwood breach exposed up to, I think it was half a billion guests, personal data, right? The plaintiffs claimed the board overreached, sorry, they breached their fiduciary duty because they were failing to oversee cyber security risks during a $13 billion Starwood acquisition. But here's the final part. Marriott won.

[00:07:56] The court dismissed the case, but the reasoning, that's what boards seem to have missed. The vice chancellor at the time said that cyber security was a mission critical risk that required board level oversight. And she said, boards have a fiduciary duty to establish reporting systems for those risks. But she also at the same time, in spite of the breach said, well, Marriott did done the right things. They consistently ranked cyber security as a top risk. The board and the audit committee,

[00:08:22] they received regular briefings. They brought in one of the big four accountants to assess Starwood security gaps. And when there was malware discovered, the CEO told the board the next day, nobody ignored red flags, which is what the court of chancery tends to look at. And the court's logic was there was a deliberate, it's a delineation between flawed effort and a deliberate failure to act.

[00:08:47] And Marriott wasn't perfect, but at least they had the governance structures in place and that's what protected them. And I think what CISOs will try and say is, well, we need to reduce risk to zero. We need to stop every breach. No, you don't. You can't prevent every breach. You need to pay your attention. You need to be able to prove that you're paying attention through things like formal oversight or documented reporting cadences or bringing in outside experts, right? Or mediation

[00:09:13] plans. Because you're not just exposing your company, you're also exposing yourself personally, which is why we've heard so much about D&O, directors and officers insurance lately, being applicable to CISOs. And security teams, they often communicate through technical severity scores while boards will think about revenue operations, maybe legal exposure and reputation. So how can these two groups create a, maybe a shared language for risk instead of just

[00:09:42] going off to talking about it in their own way? Well, I think we have to first admit like, that's not communication. It's security teams, we're sending technical reports upward and boards are sending vague directives downwards and both sides. We think, well, yeah, we're communicating, but nobody actually shares the same interpretation of the words that we're using. And the gap isn't just

[00:10:05] vocabulary, it's translation. And it runs a lot deeper than just like swapping acronyms for plain English. We, we first of all, we have to jointly define just a handful of critical terms and not unilaterally, certainly not in a slide deck, but we need to get our, our business stakeholders and our technical stakeholders and say, what is a security risk for organization? What like, you know, the, the potential to harm the business operations or reputation or compliance status from security

[00:10:34] weakness, right? That'll, that, that definition forces everyone to anchor on business impact instead of vanity metrics like CVSS scores or vulnerability counts. From there, we should have better reporting templates. Executives need to get business contacts. They need to get key findings. They need to get the decisions that they need to make and the expected outcomes. The technical details. Cool. Let's keep them. Let's put them in appendices for the people who need them. We need the appropriate level of communication for every letter for every level, not just a single

[00:11:03] report that we're trying to like send to everybody and nobody can actually read. You can also do this, through cross-functional risk workshops to do joint risk assessments with the business. And by doing that, we're eliminating the, I'll call it a translation tax that happens inevitably. Like when one hands this says, oh, that's your job now, right? Security stops being something that you report to the business. And it's something that you discuss with the business, which really helps make

[00:11:33] communication, a connective tissue of integrated risk management. Because without it, every governance thing we build up or every incentive system that we build up, it's going to eventually fracture along the same old fault lines of, oh, that's a cyber thing. That's your job. Yeah. And on that point, I mean, let's bring that to life a little. Let's say a business has identified a technology related business risk. Who should own it? And what role should a security

[00:11:59] team play after ownership moves into the business? Tell me more about that and how you'd see that playing out. You know, you're going to say this answer sounds super, super duper obvious, but most organizations have a back. A technology related business risk, odd, it flunks the business, not the security team. If a vulnerability threatens your revenue or your regulatory compliance, your operational continuity, your customer trust, whatever, the person who owns the business outcome, they're the person who

[00:12:29] owns the risk. And when you get into a risk register, that should be explicit. Every entry is going to have a risk owner and that owner should be a business stakeholder, not some security engineer. Security can identify, we can quantify, we can translate the risk into business terms, but business leaders are going to decide whether or not to accept it or mitigate it or avoid it. And that decision, again, it's the person who has the profit and loss statement at stake. So what's that leave us to do then, right? The security team,

[00:12:58] right? We're not just fobbing off our ownership. We have a lot to do. We can become advisors. We can become translators. We can monitor, we can track whether the mitigations are working, whether there's new threat intelligence says, Hey, the risk has changed. And we can also help business owners understand how the exposures change over time. We can give them the technical depth behind the business decisions without trying to overstep our boundaries and make those decisions ourselves. And that matters because

[00:13:27] security stops being the, not just the department of no, but we also stop owning problems that nobody else wants to understand. And we become a function that allows business leaders to make better choices about the risks that they're already carrying. And that's, that's a more honest way of looking at cybersecurity. And it finally, it stops us from being the scapegoat when business risk actually happens

[00:13:50] and turns into a business loss. And many organizations build a risk register, but you, they struggle to connect it with budgets and operational decisions. So what is it that turns risk management from documentation and into very real action? I love you say that some organizations have only got one risk register. It would be delightful if they only had one. I've seen multiple risk registers, but the way I look at it is a risk register that

[00:14:16] doesn't influence or control where the money goes and what people do. That's a spreadsheet. And most organizations, they've already got a really good spreadsheet. The turning point is when we stop treating the risk as a register as a documentation exercise, and we start using it as a way to make decisions. In the book, I lay out a maturity progression that makes this pretty concrete because after you agree that security risks are business risks, organizations, okay, cool. We're going to

[00:14:44] document them in business terms, but what do we do? How do we compare them against our other business risks? And it takes a little extra consideration and organizational planning so that our risk portfolio can drive investment decisions, but it eventually means that security spend needs to be fairly evaluated against every other risk investment, not some other budget silo. So the way you do that is you start with scoring. If your risk ratings can be compared across your

[00:15:10] domains, executives can prioritize. Maybe you've got a, I don't know, a five-by-five matrix with defined dollar ranges for financial impact. It gives everyone a common language. When you can say this risk has got a $2 million potential impact and medium likelihood, you've created something your CFO can actually understand and work with. Then you map your existing security projects back to your specific risks. You need to show the executives how the controls, how do they reduce the likelihood

[00:15:36] or the impact and connect each control to a business outcome. And that means our budget conversations are now like they're, they're no longer how much does security cost, but how much risk are we buying down? And finally, as I said earlier, we need to build dashboards that track residual risk over time. And when leaders watch their risk stores drop as the controls are implemented and take effect, they start to see a return on investment in real time. And that visibility is what helps turn a risk

[00:16:03] register from just another spreadsheet or just paperwork into a management tool that actually is going to earn its keep and help influence our budget cycles in a positive way. And insurance, compliance, and security controls can all create a reassuring picture on paper. But for leaders listening, how can they better test whether the business could actually withstand and recover from an incident? Anything you could share around this?

[00:16:32] Well, I'd say if you've got a clean audit report and you've got yourself a cyber insurance policy and you've got a binder full of controls, that certainly tells you what's on paper. It doesn't tell you anything about what's going to happen at 2 a.m. on a Saturday when your systems go dark and the phone starts ringing. Right? Testing real resilience means putting the business through scenarios that are like an actual incident, not what a compliance checklist imagined ones feels like. But it can be measured through

[00:16:58] operational resilience metrics, recovery time objectives, disaster recovery test results, incident response effectiveness. Those aren't theoretical measures. They're proof points. Either your systems come back within the window that your business depends on or they don't. And our most effective way of looking at that is layered exercises, tabletop exercises to walk your leadership through decision-making under pressure. Like who calls a regulator? When do you notify

[00:17:26] your customers? Who is going to authorize a ransom payment? And those all seem like, you know, we've written it down until you get in the room and nobody actually knows the answer. And then you do technical recovery tests and make sure like your backups actually restore, that your failover actually works and that your incident response playbook holds up under pressure in a realistic scenario. In the book, I talk about the value of having decision trees through different risk response paths and

[00:17:53] impact scenarios demonstrating potential business consequences and investment models comparing our control options. But they give us a way to rehearse our decisions before it becomes urgent because, you know, compliance is in security and resilience is in the document. It's got to be demonstrated and it's got to be tested under conditions that are going to be as close to reality as you can make them. And I'd love to give people this thing a valuable takeaway here. So if we do have a board member

[00:18:20] that's tuning in, trying to get a heads up on this, what should boards be asking management today to find out whether cybersecurity is integrated into enterprise risk management or still just operating as a separate technical function? You know, when the SEC thing first happened in 2023, there was this whole thing of like, Hey, we're going to educate all the board members. It'll be great. And then that proposal died and we realized, huh? So what do we do now? And boards don't need to be technical experts

[00:18:50] to ask the right questions. They need to ask questions that figure out like, is security a business function or is it hiding behind a technical one? Start with ownership. Ask who in the business owns every top tier risk in your register. If your answer is always, Oh, it's the CISO or it's the head of IT. Security is not integrated. It's, it's carrying risks that belong to the business leaders. Business functions should own their risks. Security should advise monitor and translate,

[00:19:17] but it should be left holding the bag. Ask whether your security risks, like we said earlier, are in the same risk register. Okay, cool. Are they, and then are they actually categorized as operational or financial or strategic risks? If not, it's still not integrated. I also put a maturity model too many years of consulting into the book. Um, and at the traditional level, security risks are a separate world, separate risk register, separate everything. If you get to optimal,

[00:19:43] you can evaluate them using the same criteria as every other business risk. Cause if, if your management team can't show you a single integrated view of your risks, you're looking at a silo and then like ask, how are you measuring performance? If the metrics are vanity metrics, your vulnerability counts, your patch rates, your, your CVE totals, you're hearing a technical report. If they're saying this is your business impact, this is your cost avoidance, this is your risk reduction against

[00:20:09] your enterprise business objectives. You've got an integrated one. And finally, if you've had something recently happen, ask what happened after your big security incident? Was it a, was it a technical event and patched and closed? Or did you do a cross-functional, a horizontal review that involved your legal and your finance and your ownership and your operations and your business leadership? Managers are going to tell you everything there. It's not because the words are

[00:20:34] going to be interesting. It's because integrated risk management leaves evidence. Siloed risk management is going to leave a heck of a lot of gaps. And your passion for this topic really shines through. And I've got to ask you, cause writing a book is a big commitment and takes hours, days, weeks, weeks, months, sometimes years. So what inspired the book? Is it, was it a history of lots of war stories in you and thought, I'm going to try and make a difference here. What made you want to

[00:21:00] sit down and, and bring this to life? Um, I feel like I've been in an Alcoholics Anonymous meeting for most of my career. That's, that's the, the plain and simple way of looking at it is we keep doing the same thing and expecting a different result. And I've had the privilege of doing executive advisory on three continents with very small entities to fortune 500 entities in multiple languages.

[00:21:23] And I kept seeing the same fundamental problem where we want so many people. If you look at our receipts that we have for cybersecurity certifications or our degrees, in some cases, they teach us we're supposed to do all this risk reduction. And then we talk to the business and we say, well, how are you going to reduce the risk? And they weren't interested in the conversation. So, so many of us just said, well, I've been trained to do this and we've overstepped our bounds. We have grossly in some

[00:21:51] cases, overstepped our bounds of what we should do. And now a lot of us are burning out as a direct consequence of saying, I keep trying to fix this thing. And you don't realize you don't own the thing. You can't fix a risk. That's not yours, which is why we're seeing the current burnout cycle in cybersecurity. That is a lot of the inspiration of, of writing the book. Also, I just, you know, I had wondered if I had it in me more than anything else, which is why I went with a,

[00:22:17] you'll appreciate this, Neil. It's a UK based publisher, Taylor and Francis. They own CRC press. They were out of the, uh, I got 14 rejection letters and then, uh, Gabby over at Taylor and Francis said, yeah, we'll take a swing at that. So, um, so happy that the book's coming out at the, uh, end of September. End of September. Awesome. So where can people find out more information about you, find you online, learn more about the book before it comes out? Where should they go?

[00:22:42] Okay. So I am at Kane McGladdery.com. Um, my mom and dad gave me the worst opsec ever. There is, he just ask any search engine. There is exactly one version of my name. I am it. And if you want to learn more about the book, uh, go to Kane McGladdery.com slash myth, which has got all of the resources from the book. They told me I'm not writing a textbook. So there's like 70 files you can download as well as an open question, like whether or not there should be a course, not just a book.

[00:23:08] And at the end of September, 2026, you can buy the book wherever you buy books, or if you like your libraries and I love my library, go out, request a copy through your library. Well, it sounds like your parents give you the greatest gift of all the one name you could search at these only years. It's an amazing gift there, but I will have links to everything that you mentioned. I encourage people listening to check it out. And if you buy the book, you pre-order it, you read it, and you got anything you want to feedback to, I've also loved to hear from you as well,

[00:23:36] but more than anything, Kane, just thank you for bringing all this to life in a language everyone can understand. And finally later rest a few demons in the industry too. Thanks for joining me. Thanks so much, Neil. I think Kane leaves us with a useful test for cyber security governance today. If cyber risks sit in a separate register, use a separate vocabulary, and are owned by the CISO

[00:24:03] regardless of the business outcome, essentially security is still operating in a silo. But the alternative is shared accountability. Business leaders must own the decisions about risks to their outcomes. While security identifies, quantifies, translates, and monitors those risks. And that makes budget

[00:24:26] discussions less about the cost of security and more about how much exposure an investment reduces. So you can learn more about Kane and access resources from Cyber Risk is a Myth at kainmcgladry.com slash myth. The book is due for release at the end of September. And I'd love to hear how this could work in your organisation. Does your business truly own its technology-related risks?

[00:24:54] Or does accountability still stop at the security team when something goes wrong and everything turns into the Spider-Man meme with everybody pointing at each other? As always, share your thoughts with me at techtalksnetwork.com. Remember you can meet me on the road. I'm back-to-back events for the rest of the year, so it'd be great to meet some of you in person. But that is it for today. So thank you for listening as always. Bye for now.