Cyber Risk Is Not a Special Snowflake
Walk into a CFO’s office and announce that you’ve got a 9.8 on the Common Vulnerability Scoring System (CVSS) for a production server, and watch what happens. Nothing happens. The CFO has eleventy billion other things to think about and no way to judge whether a 9.8 is a five-alarm fire or a rounding error. Walk in and say the same problem costs the business $2 million a day, and you’ve given them a reason to act.
That contrast was the basis of a conversation I had with Daniel Tangney on GRC Radio, joined by Sid Roper of Compyl. The premise we kept returning to that treating cyber risk as its own category, measured with its own metrics and reported in its own language, fragments accountability and drives bad business decisions.
“They don’t know if this is important. They don’t know if it’s a probability. They don’t know if it’s a hunch.” — One executive, after a board meeting where security presented a risk heat map
That was Sid’s answer when Dan asked where a typical risk register dies at the CFO’s desk.
The Separation Tax
The best example of fragmented accountability is third-party risk, because it sits on the seams between procurement, IT, and legal with no natural home in any of them. Procurement assumes IT owns it, while IT assumes it’s some business function handled by legal. Legal assumes both of the others have it covered. The risk survives precisely because everybody believes somebody else is handling it, and nobody has ever been asked to sign their name to the assumption.
The misallocation takes several forms:
- A critical vulnerability reported on a dev server gets patched overnight because the technical score says critical, but a moderate vulnerability in the payment processing system waits in a ticket queue, because the score says medium and doesn’t know what a payment processing system is.
- Security teams deploy controls with no business buy-in, employees route around them, and the money spent buys nothing but resentment.
- Business units duplicate investments to solve the same risk independently.
- Expensive technical solutions get purchased where a process change would have worked better, and total cost of ownership gets ignored because renewals are a year-two problem. Year two is someone else’s fiscal concern.
If you evaluate cyber risk with one framework and every other business risk with another, your organization cannot rationally answer the only question that matters. Where should the next dollar of risk reduction go?
What’s Broken About the Register
Sid described the typical risk register as he encounters them, and it matched what I’ve seen at dozens of companies. Somebody built a beautiful, color-coded Excel spreadsheet once, interviewed people, typed things in, and filed it away. Once a year, someone touches base with it. The register means something to its creator and nothing to anyone else, which is the definition of a checkbox exercise.
The rating hides the substance
Two risks both rated high can have nothing else in common. One carries regulatory exposure. The other affects a low-volume system nobody depends on. The register doesn’t tell you which is which, so the executive reading it can’t either.
The timeline gets flattened
Impact is nonlinear. A 1-hour outage is annoying, 4 hours brings contract penalties, and a week threatens the viability of the business. Most registers record all three of those as the same rating.
Nobody signs for it
When a committee owns a risk, no one owns it, and everyone in the room privately knows this. Every risk on the register needs a named business owner who will either address it or formally accept it. Anything less is inventory rather than governance.
Sid and I spent the better part of the hour trading versions of that same story.
Metrics Executives Will Use
Every quarter, security leaders walk into boardrooms armed with activity metrics, and every quarter, the other executives politely ignore them. These measure what security did, and none of them connect to anything the business is trying to accomplish. I’ve never seen a decision change because of how fast an organization patches.
| The activity metric | What it tells an executive | Replace it with |
|---|---|---|
| Patch compliance percentage | How hard the team worked | Revenue protected |
| Raw vulnerability counts | How loud the scanners are | Mean time to detect and respond |
| Training completion rates | Attendance | Compliance friction reduced, in hours returned |
Anthropic’s Mythos vulnerability search capability and OpenAI’s Daybreak made the noise problem considerably worse, flooding pipelines with findings that, on later review, turned out to be nothingburgers, duplicates of vulnerabilities other researchers had already reported, or low-value items demanding enormous human validation effort. Once AI-assisted scanning made everything go beep, the beeps drowned out what little signal remained.
Apply a simple litmus test to every metric on your slide. Go back through last quarter and name a decision that changed because someone looked at that number. If nobody can name it, delete it.
Then rebuild from the other direction. Your company’s annual report states the business objectives, so find the security contribution to each one. Where you can’t find it, you’ve identified a gap worth filling.
That color-coding cuts the other way, too. Roughly 1 in 12 men has some form of color vision deficiency, according to the National Eye Institute, and more than a few executives have quietly taken me aside after a presentation to ask what the heat map said, because brown and gray looked identical to them. Your carefully shaded five-color matrix may be unreadable to part of your audience, so design accordingly.
Speak in Ranges, Show Your Math
Lawyers never give a single number, and CFOs trust lawyers. Give a defensible range, from a likely case to a high extreme, then show the assumptions behind all of it. Transparency about your math builds credibility, while confidence you can’t back up invites exactly the skepticism it deserves.
Be cautious with formal quantification programs, though. If your organization has nobody whose job title includes the word “quant”, the plumbing required to build defensible figures can cost more than the risks you’re trying to prioritize. I’ve watched that exercise consume more budget than the resulting projects would have. A transparent range with documented assumptions beats false precision nobody believes.
The vocabulary that lands in the C-suite is financial, and it isn’t hard to learn. Return on investment (ROI), payback period, total cost of ownership, and annual loss expectancy (ALE) are all terms your CFO already uses daily. Frame every proposal with the cost of the risk, the defensible range of outcomes, and the cost to fix or reduce it laid out side by side. The executive is then comparing figures rather than reacting to fear, which is how decisions actually get made.
“We do math. That’s governance.” — Sid Roper on the GRC Radio episode
Stop Owning Risks You Don’t Own
In the three-lines-of-defense model inherited from banking, the first line operates the controls, the second verifies the first line is doing it, and the third audits both. As a second-line chief information security officer (CISO), my job is to verify that controls are operated by the people who own them. The controls belong to the business functions that run them, and so do the risks.
A risk shows up that no one claims, and the CISO catches the pop fly because professional identity tells them they must own everything. Then they implement controls without organizational change management and wonder why sales works around every single one.
People don’t get fired for violating security controls. People get fired for not doing their jobs on time. — Kayne McGladrey
If your control imperils someone’s ability to hit their numbers, they’ll route around it. That’s how we got shadow IT, and it’s how we’re getting shadow AI now.
The boring prescription
Start with a responsible-accountable-consulted-informed (RACI) chart for the processes that make and move money, beginning with accounts payable, accounts receivable, and your top three revenue generators. Name a single accountable person for each, someone who can say “I accept this risk” and have it mean something. Without that named acceptor, the register is theater.
What boards actually require
According to the decisions coming out of Delaware’s Court of Chancery, the legal bar for directors is that they were informed, not that they were given perfection. Show up, be legible, give them facts. The habit compounds, because every analyst you teach to explain risk in dollars becomes a future leader who never has to unlearn the old approach. Translation is the job. It always was.
Cyber Risk is a Myth is out now from CRC Press, and more than 60 of the workshop resources referenced in it are free to download at kaynemcgladry.com/myth. The full GRC Radio conversation with Daniel Tangney and Sid Roper is here.
