Translate Cyber Risk Into Business Decisions

Turn cyber risk into board-ready business decisions

Based on Cyber Risk is a Myth: A Business Approach to Integrated Risk Management (CRC Press, 2026). Designed for CISOs, GRC leaders, and security professionals who need to explain risk clearly, influence decisions, and speak the language of the boardroom.

Why This Course?

CISOs, GRC leaders, and security professionals don’t lack technical expertise. You need to translate vulnerability scans, ransomware exposure, and third-party risk into budget decisions, strategic priorities, and risk appetite statements that executives will approve.

Over 10 weeks, you’ll complete real-world exercises including:

  • Decision Rights Mapping for Security Risks
  • Governance Structure Assessment (centralized, federated, or hybrid)
  • Risk Appetite Statement Development Framework
  • Security Governance Maturity Benchmarking

Potential pricing: $500 (self-paced) and $2,500 (instructor-led cohort).

Headshot of Kayne McGladrey

About Your Instructor

With nearly three decades advising Fortune 500 and Global 1000 companies, I specialize in turning complex cybersecurity risk into business decisions. My book Cyber Risk is a Myth (CRC Press, 2026) provides the methodology behind this course. I’m a CISSP, senior IEEE member, and consistently the #1 thought leader for risk management and cybersecurity according to Drata, SecureFrame, and others.

Reserve My Spot (Free)

Select which course you're most interested in; if you pick both, you'll be getting twice as much email, but not necessarily twice as much value.

Select list(s):

No payment required. You’ll get launch updates, early access details, and a chance to influence the curriculum.

The Book Behind the Course

The artificial separation between security and enterprise risk management is false. Security risks are business risks. They threaten revenue, reputation, and strategic execution, and treating them as a technical specialty managed by IT creates the fragmented accountability that leads to catastrophic failures.

My book argues this case across ten chapters and 312 pages, supported by 60+ worksheets, workshops, and frameworks you can deploy in your organization immediately. Where most cybersecurity books focus on technical controls, this one teaches you how to translate vulnerabilities into business impact, build governance structures that assign clear ownership, and reposition security as a strategic enabler rather than a cost center.

Cover image Cyber Risk is a Myth

Publication Details:

  • Publisher: CRC Press (imprint of Taylor and Francis/Routledge)
  • Publication date: September 25, 2026
  • ISBN: 9781041249054
  • Pages: 312
  • Pre-orders open: September 23, 2026
  • Books ship: October 14, 2026

Pre-Order on Routledge.com

Explore additional resources at: kaynemcgladrey.com/myth

Why a Course, Not Just a Book?

Reading a book gives you knowledge. Implementing its frameworks inside a live organization, with all its political complexity and competing priorities, requires practice. The 60+ resources from my book are designed to be used, not read. A course would give you structured sequencing, feedback on your actual organizational context, peer discussion, and accountability to work through the material end to end.

Proposed 10-Week Course Structure

This course doesn’t exist yet. I’m gauging interest before building. The structure below is what I’m considering, mapped chapter by chapter to the book. If there’s enough demand, I’ll refine this based on survey feedback from people who sign up.

Here’s what each week would cover:

The first week would have you diagnosing your organization’s current risk communication breakdowns and identifying the specific translation gaps preventing executive action. You’d complete the Security Investment Prioritization Matrix and the Benchmark Your Organization exercise to establish a baseline. This week introduces the Compliance Trap, the tendency to focus on regulatory checkboxes rather than actual business risk exposure, and sets up why siloed security fails before introducing solutions.

This week focuses on converting technical findings into financial and operational impact statements that executives can act on. You’d work through the Risk Communication Decision Tree and the Business-Focused Vulnerability Translator. The approach uses the Dual-Process Theory of risk to explain why executives ignore technical reports, not just what to say instead.

Week three would have you mapping vulnerabilities to specific business functions and quantifying potential financial exposure in dollar terms. You’d complete the Risk-to-Value Mapping Framework and run through the Cross-Functional Risk Translation Workshop using real vulnerabilities from your environment, not hypothetical scenarios. The Risk Register Template and Vulnerability-to-Business Impact Mapping Framework would give you structured tools for ongoing documentation.

Here you’d design governance structures that assign clear risk ownership to business units while leveraging security expertise. The Cross-Functional Risk Assessment Workshop and Risk Acceptance Decision Framework would be the primary worksheets. This week tackles the most common failure point in risk management: risks that fall through the cracks because no one owns them. You’d also use the Security-ERM Integration Maturity Assessment Framework to evaluate how well security risks are integrated into your enterprise risk processes.

This is where you’d construct investment proposals using Total Cost of Ownership (TCO), Annualized Loss Expectancy (ALE), and Risk Reduction ROI calculations that your finance team can understand. The Security Investment Financial Analysis Toolkit, Security Investment ROI Calculator, and Business Impact Quantification Calculator would be your core tools. The Executive Objection Response Toolkit would prepare you for the pushback you’ll inevitably face. This week teaches financial modeling specifically for security, not generic business case skills.

Week six would have you auditing your current metrics and designing stakeholder-specific dashboards that executives actually reference in decisions. You’d complete the Security Metrics Audit Tool and the Dashboard Design Workshop, plus the Exercise: Designing Your Metrics Framework and Exercise: Developing Stakeholder-Specific Reports. The Security Metrics Hierarchy would help you separate operational, tactical, and board-level reporting requirements so each audience gets what they need.

Here you’d choose and customize governance structures, whether centralized, federated, or hybrid, for your organization’s scale and culture. You’d complete the Decision Rights Mapping exercise, the Decision Authority Matrix for Security Risks, and the Governance Structure Assessment. The Risk Appetite Statement Development Framework would give you a structured approach to defining risk tolerance. This week includes tiered escalation thresholds adapted from real-world implementations, along with the Security Governance Maturity Assessment to benchmark your current state.

Week eight is about assessing your current risk culture maturity and designing interventions using the LILAC framework: Leadership, Involvement, Learning, Accountability, and Communication. You’d complete the Risk Culture Maturity Assessment and the Security Incentive Design Framework, plus the Organizational Silo Mapping Exercise and the Role-Based Risk Awareness Program Template. This week tackles behavioral change through incentive design, not just training. The Cognitive Bias Identification exercise would help you recognize and counteract the mental shortcuts that sabotage risk decisions.

This week shifts the lens. You’d identify where security creates competitive differentiation and build business cases for market advantage. The Security Business Enablement Matrix and the Security Competitive Differentiation Framework would be the primary worksheets, supported by the Security Investment Business Case Template and the Executive Security Value Communication Toolkit. You’d reframe security as a revenue driver rather than a cost center, with concrete frameworks for proving that value to executives.

The final week would have you creating a customized roadmap to move your organization from siloed to integrated risk management, with milestones and success metrics. You’d complete the Security-Business Integration Maturity Assessment and the Build Your Custom Implementation Plan exercise, plus the Security Integration Challenge Resolution Toolkit. By the end, you’d walk away with an actionable 12-month implementation plan for your organization, backed by the Identify Your Organization’s Transformation Opportunities exercise to prioritize where to start.

Reserve your spot (free)

Proposed Course Tiers

If the course launches, it would be offered at two tiers. Neither is confirmed. Pricing and structure may adjust based on survey feedback.

Self-Paced: $500 (proposed)

Format: 10 modules of pre-recorded video content (approximately 90-120 minutes per module), downloadable worksheet pack with all 60+ templates, lifetime access to course materials and future updates.

Support: Community forum access for peer discussion, monthly office hours Q&A sessions, email support for technical questions about worksheet implementation.

Ideal for: Solo practitioners who need flexibility, organizations with distributed teams across time zones, learners who prefer to work at their own pace.

Time commitment: 3-5 hours per week over 10 weeks.

Cohort/1:1: $2,500 (proposed)

Format: Weekly 90-minute live mastermind group sessions (recorded), bi-weekly 30-minute 1:1 coaching sessions with me, all pre-recorded content included, private cohort Signal channel, custom worksheet feedback on your actual organizational challenges.

Support: Direct access to me via email for urgent questions, personalized feedback on implementation plans, peer accountability group matching, invitation to exclusive alumni network.

Ideal for: Senior leaders who want accountability and hands-on guidance, organizations sending multiple team members together, professionals implementing at scale across large enterprises.

Time commitment: 4-6 hours per week including live sessions, homework, and 1:1 meetings.

How This Works

I’m running a validation campaign, not a course launch. Here’s the process, step by step.

Step 1: Sign Up (Free)

Enter your name, email, and preferred tier on the form below. No payment required. This adds you to the interest list and gives you early access if the course launches.

Step 2: Take the Survey

Answer three quick questions to help me shape the course. Tell me your biggest challenge and your preferred tier. Takes under two minutes.

Step 3: Hold Your Spot (Optional)

Place a $10 refundable deposit via Stripe. This credits toward your enrollment if the course launches by December 5, 2026. Fully refunded if it doesn’t.


DateMilestone
September 23, 2026Book pre-orders open
September 25, 2026Book publication date
October 14, 2026Books ship
December 5, 2026Go/no-go decision announced
December 12, 2026Refund deadline (if course doesn’t launch)

Want to talk through whether this fits your needs? Book a free 30-minute call with me on Proton Meet.

Before You Place a Deposit

This course doesn’t exist yet. I haven’t begun development. I’m gauging interest to decide whether to build it. Placing a $10 deposit signals your interest and reserves a spot if the course launches.

If there’s enough interest by December 5, 2026, I’ll begin building the course and your $10 deposit will be credited toward your enrollment fee. Course materials would be delivered within 1-2 weeks of the go/no-go decision.

If there’s insufficient interest, all deposits will be fully refunded by December 12, 2026. You’ll receive updates about the decision regardless of the outcome.

Reserve My Spot (Free)

Signing up is free. Here’s what you get:

  • Early access if the course launches, before public enrollment opens
  • A 20% off book discount code, delivered in your confirmation email
  • A link to the three-question survey to help shape the course
  • Updates on the go/no-go decision by December 5, 2026

Select which course you're most interested in; if you pick both, you'll be getting twice as much email, but not necessarily twice as much value.

Select list(s):

I won’t share your email. No spam. You can also subscribe to my newsletter for regulatory and legal analysis of cybersecurity at kaynemcgladrey.com/newsletter/.

Frequently Asked Questions

Integrated risk management means treating security risks as business risks within a unified framework. The book’s central argument is that the artificial separation between security and enterprise risk management is false and dangerous. Security risks impact revenue, reputation, and strategy. Managing them as a technical specialty siloed from the business creates the fragmented accountability that leads to breaches like Equifax and Target.

The book provides a six-step Risk Translation Framework: identify the risk, determine potential business consequences, quantify the financial impact, establish timeframes, link to strategic objectives, and present solutions with resource requirements. The Cross-Functional Risk Translation Workshop walks mixed teams of technical and business stakeholders through this process using real vulnerabilities from your environment.

LILAC stands for Leadership, Involvement, Learning, Accountability, and Communication. It’s a model for building collaborative risk ownership across business units. Rather than relying on training alone, the LILAC framework addresses the cultural and behavioral root causes that technical controls can’t solve, including incentive design and shared accountability.

Stop tracking patch rates and vulnerability counts. Start measuring revenue protected, costs avoided, and operational efficiency gained through security activities. The book’s Security Metrics Hierarchy separates operational, tactical, and board-level metrics so you can tailor reporting to each audience. The Security Metrics Audit Tool helps you score your current metrics on business relevance and replace or eliminate those that score below 6 out of 10.

Business unit leaders own the risks associated with their operations, supported by security expertise. The Decision Authority Matrix defines who is Responsible, Accountable, Consulted, and Informed for each decision type, from security strategy through incident response. Escalation thresholds based on potential financial impact ensure that high-risk decisions reach the right authority level.

No. This course is built on the argument that compliance is a baseline, not a goal. The book’s Compliance Trap concept warns against treating regulatory checkboxes as risk management. The course would focus on business enablement, financial quantification of risk, and strategic positioning of security, not on passing audits. If you’re looking for compliance-specific training, this isn’t the right fit.

If you’re a CISO, this course would give you frameworks to communicate more effectively with your board and business unit leaders. If you’re a business executive, it would teach you how to understand and own the security risks in your domain. If you’re an auditor or board member, it would help you assess whether your organization’s risk governance is mature enough. The course is designed for anyone who needs to bridge the gap between technical security and business strategy, not just technical practitioners.

If I decide not to build the course by December 5, 2026 due to a lack of interest or other unexpected factors, your full $10 deposit will be refunded by December 12, 2026. You’ll be notified either way.

December 5, 2026 is the go/no-go decision date. I’ll announce the outcome to everyone on the interest list, regardless of whether the course proceeds.

Yes. If the course doesn’t launch, all deposits are refunded in full by December 12, 2026. No additional charges will occur until the course is confirmed and you elect to enroll.

Understand the stories that matter.

Every week, I break down the most important updates in cybersecurity and AI law and policy. Human-written, deeply analyzed.

I don’t spam! Read the privacy policy for more info.