The Cloudy Road to Cyber Risk Management

The initial transition commenced in 2006 when AWS brought to market the first enterprise ready cloud service offering. A couple years later in 2008 Microsoft and Google, both introduced their respective competitive cloud services. Up to that point, businesses were primarily on-prem, owning their entire technology stack of solutions and services. The business viewed risk in terms of financial stability, operational efficiency, physical controls with increased awareness on cybersecurity, regulatory compliance, and market competition.

Three years later in 2011, Microsoft launched their SaaS Office 365 offering, further persuading businesses to expand their footprint well beyond their physically controlled on-prem architecture. This expansion led to an explosion in cybersecurity tool development to address gaps in visibility, detection, response, governance, controls, compliance, and overall rapid industry innovations. 

The list in Figure 1 was created by Graham Mann. He started building a cybersecurity vendor database in 2009 and by 2011 he felt the foundation was strong enough to publish his list, but it was still a work in progress. In 2018, with so many changes to the market, he thought it would be interesting to evaluate again for comparison. The growth in total number of solutions is a huge difference, 2011 (1683) to 2018 (7019). He said some of this can be contributed to his database still being a work in progress in 2011, but this clearly indicates the effects cloud and SaaS has had on the technology industry. It’s fascinating to see a time when Cloud Security only had 5 vendors!

 Figure 1 Cybersecurity Solution – 2011 compared to 2018

Key: * No vendor identified in 2011

        # Data not gathered in 2011 for these categories

        ~ Anti-Virus companies were listed under Anti-Malware in 2011

        @ Listed under IAM in 2011

In the middle of this cybersecurity revolution NIST released their Cybersecurity Framework (2014), to provide structure to any organization in creating, accessing, and improving their cybersecurity programs. By 2017, an executive order invoked mandatory use for all U.S. federal government agencies.

With this uptick in cybersecurity regulations Governance, Risk, and Compliance (GRC) teams had a new area to identify, assess, mitigate, and report the organizations risk. These teams have long been in place for many businesses, but their aptitude was largely in finance, auditing, and the language of the business. The shift to the cloud changed the businesses risk trajectory into new and unforeseen ways and continues to do so today with the disruption of AI. These GRC teams are now faced with rapidly learning the elements of cybersecurity as they relate to GRC and managing the businesses risk.   

The table in Figure 2 published by Gartner in 2024, shows the year over year growth of Integrated Risk Management which is increasingly becoming comprised of virtual cybersecurity triggers and controls in contrast to the days of constrained physical location risks.

Figure 2 Security and Risk Management End-User Spending for All Segments, Worldwide, 2022-2024 (Millions of US Dollars) – Gartner

For organizations without GRC teams, they may solely rely on IT leaders to convey the risks. These leaders have traditionally focused on the technical nuances of architecture, maintenance and performance, security, threats and vulnerabilities, and reporting. They are fluent in technical language and sometimes have difficulty translating the risk in terms the business can understand. 

Both GRC teams and IT leaders have faced difficulty in conveying the value of cybersecurity, in terms of associated risk to the business and in the significance it holds within the organization. We are on the verge of bringing these groups together in a more cohesive way to better align and express the inherent and residual effects associated with cybersecurity. 

A few examples of resources GRC teams can leverage:

• Security Frameworks – NIST/ISO/IEC have several publications around building a foundation, running assessments, recommended techniques, controls, and practices for organizations.

• Cyber Risk Quantification (CRQ) solutions – many offer additional components such as Cyber-Risk Register, Continuous Control Monitoring, and Framework crosswalk.

• Third Party Risk Management (TPRM) solutions

• Sayers Services:  

o Business Impact Analysis (BIA) – aids in attributing revenue values to applications, services, the business uses. 

o Risk Assessment – a variety of offerings tied to your framework of choice. This can help you ascertain specific risks your organization faces, with direction on ways to reduce the risks. 

o Bowtie Exercises – tabletop exercise where you pick a specific “event or condition” that could impact the business and go through scenarios that trigger or cause the event. Then on the other side, walk through your organizations responsive actions and controls to gage an associated impact based on your current policies in place. 

(We can help if these terms are new to you!)

Please reach out to hello@sayers.com if you are interested in a deeper risk conversation.