<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

Day two of RSA and booth number 1641 is bustling. In fact, the entire Expo Hall is awash with new product announcements, compelling demos, and striking amounts of swag. The CyberSaint team has been exploring the neighborhoods of Moscone Hall since things got kicked off on Monday and we’ve seen many trends emerge throughout the host of exhibitors -

Risk and compliance becomes embedded

CyberSaint Chief Product Officer, Padraic O’Reilly, noted the amount of compliance and risk features and functionality emerging in products regardless of where they sit in the network. This points to a larger trend within the enterprise context that non-technical stakeholders are increasingly relying on CISO’s to articulate the cyber risks facing the organization. As we’ve written about before, though, the challenge is defining and articulating these new forms of risk in the same context as existing risk forms (financial, operational, etc.). This groundswell of business leaders relying on digital risk managers and information security leaders has driven vendors to begin integrating more and more risk quantification into their products.

Almost, but not quite...

Seeing more and more solutions working to integrate risk features into their solutions has some vendors working to play catch up. We saw many presentations using phrases like “understand risk and roll up it up,” again pointing to the need for this information to transcend beyond technical stakeholders. However, the challenge here is not simply collecting the data and possibly visualizing it but translating it into a context that is of value to non-technical stakeholders.

Padraic noted “I saw a lot of tools that used terms like ‘management dashboards’ but these tools did not [in fact] roll up to something that delivered context to non-technical stakeholders.”

The greater issue that the cybersecurity industry as a whole is facing is the need to shift the perspective from simply working as a misunderstood technical unit to a business function that is more and more depended on for business strategy, execution, and growth.

What’s tempting for organizations launching risk quantification features is the idea of cooking up a secret sauce and protect it as intellectual property. However, as we’ve seen with open source cybersecurity frameworks link the NIST CSF, the power of open source platforms increases the rate of standardization, innovation and security. Furthermore, empowering a CISO to articulate how they came to their conclusions on their organization’s risks is a critical step for communicating that to the board. Black-box risk methodologies stifle the rate that CISO’s can standardize and learn from others in the process, as well as their ability to discuss cyber risk, which in turn stifles an organization’s ability to grow.

The precursors to consolidation

Talk to anyone in cyber and you’ll hear about how congested the space is. What is apparent at RSAC 2019 is the beginnings of a consolidation - we saw it in the compliance space with Rsam and ACL and will continue to see more and more similar players start to merge and acquire in order to survive.

Aside from larger steps, we’re also seeing an increasing number of integrations across platforms. As CyberSaint CEO, George Wrenn, put it - “everything is salt and pepper.” This further points to value for the customer - rather than having to stitch together a patchwork of solutions (and even worse having to source them all with little guidance) we’re seeing vendors start to anchor around each other to create a network solution for end customers. As this network becomes tighter, the rate of M&A will accelerate and culminate with holistic solutions rather than specific function based products.

Integrated risk management is more than better GRC

For many vendors and practitioners, the view of integrated risk management is that it is the next step for risk and compliance and rightly so, it is how Gartner coined the term. However, what we’re seeing at RSA is that IRM is more than simply looking beyond checkbox compliance and shifting to a risk focus over compliance. What we see happening is IRM is the means to unite these disparate solutions. True IRM solutions are the single pane of glass that gives management insight into the digital health of their organization and unites the many facets of a cyber program while transparently helping CISO’s articulate the cyber risk facing their organization.

As more and more legacy GRC products attempt to rebrand themselves as IRM, but the fundamental principles of IRM continue to take shape, the disparity between the marketing of legacy GRC and its actual abilities will become more and more apparent. All other trends, from salt and pepper to the embedding of risk, indicate that the industry needs (if it isn’t already demanding) a unified approach to compliance and risk that empowers managers to make decisions and collaborate rather than swinging spreadsheets or spending hours bouncing through a heavyweight solution with little to show for it. As we've said before, in the immediate future there is room for both IRM and GRC - the long term impact, we predict is a change in function for legacy GRC platforms with IRM sitting atop.

Stay up to date with all CyberSaint’s activity at RSA and follow us on LinkedIn and Twitter.

You may also like

Compliance and Regulations for ...
on January 9, 2023

Compliance for many cybersecurity programs has been the cornerstone and the catalyst for why many programs exist in the first place. Since the rise of the information technology ...

Cyber Risk Quantification: Metrics ...
on January 6, 2023

Risk management is the new foundation for an information security program. Risk management, coupled with necessary compliance activities to support ongoing business operations, ...

Padraic O'Reilly
Cybersecurity Maturity Models You ...
on December 30, 2022

Cybercrime has forced businesses worldwide into paying billions of dollars yearly. As more of the population becomes dependent on technology, the fear of cyber attacks continues ...

Top 10 Risks in Cyber Security
on December 23, 2022

Increasing cyber security threats continue creating problems for companies and organizations, obliging them to defend their systems against cyber threats. According to research ...

Governance and Process Automation
on December 21, 2022

Any enterprise operating at scale understands the need for standardization and strong corporate governance. Having served Fortune 50 companies for decades, I have seen the ...

Jerry Layden
Introducing Crosswalking Templates
on December 19, 2022

Crosswalking can be a handy tool to view control performance for a single asset/system against multiple frameworks. One can complete an assessment using one framework by ...