Cyber risk now carries a balance sheet. The ability to put a dollar value on risk—and a return on remediation—is becoming the difference between organizations that move with confidence and those that stall under uncertainty.
The opportunity lies in clarity. Amid endless data points, cyber risk leaders are learning to distinguish true risk signals from background noise. AI and unified models are helping translate those signals into decisions that are faster, more precise, and easier to explain in business terms.
The Cyber Risk Series: Risk Management Edition brings together industry experts to share how organizations are building this clarity into their programs. The focus is practical: how to measure, prioritize, and communicate risk in ways that guide strategy, secure investment, and strengthen trust.
Wednesday, September 24, 2025
Virtual
For every new digital breakthrough, be it cloud native, quantum computing, or AI, a raft of new operational and business risks arises. Modern enterprises accelerate digital and AI transformation, but adversaries match their pace—pushing back with equal force and sophistication.
In this candid fireside chat, Qualys’ Rich Seiersen, Chief Risk Tech Officer sits down with CEO Sumedh Thakar, to explore the evolution from attack surface management (ASM) to risk surface management (RSM), the emergence of the Risk Operations Center (ROC), and how AI is reshaping both risk and the future of cybersecurity work. Together, they’ll unpack what it takes to move from tactical firefighting to a risk-based strategy that aligns security with enterprise value.
Security leaders are being asked to cover more ground with fewer people and tighter budgets. The result should sound familiar: teams running faster every year, but always behind. The problem is not effort. The problem is that technology risk is still being presented in a way that does not motivate executives to take action.
Too often, the conversation is about moving boxes from red to yellow to green. That framing makes risk appear to be a compliance task rather than a business decision. This talk is about upgrading the conversation. By speaking in the language executives already use: tradeoffs, investments, opportunity costs, and resource allocation, security leaders can shift from reporting problems to shaping strategy.
Attendees will learn how to:
Cyber models and third-party datasets can provide valuable tools for understanding, quantifying, and managing cyber risks. They enable companies to make data-driven decisions, help to enhance cybersecurity posture, and empower organizations to effectively respond to the evolving threat landscape. No cyber datasets are one-size-fits-all, nor are they created equally, however. They should align with an organization’s specific requirements and existing cyber risk management capabilities, and they should have actual correlations with risk.
In this session, we’ll discuss how the world of cyber insurance has unique resources to separate the good from the bad from the snake oil. By using the set of companies that had cyber insurance claims, along with the universe of companies that purchased cyber insurance, we can determine which of this myriad of tools has actual correlations with cyber incidents. We’ll evaluate cyber self-assessments, outside-in scans, and dark web threat intelligence, amongst others. We’ll also look at various vendor quantification models that are being used by the cyber insurance industry and how they may impact your organization.
As cybersecurity programs evolve, organizations are exploring new approaches to operationalize risk management at scale. Just as the SOC transformed threat monitoring, the Risk Operations Center (ROC) is emerging as a model for unifying cyber risk management across people, processes, and technology.
In this fireside chat, Jonathan Trull, CISO of Qualys, and Rahul Goel, cybersecurity leader and former CISO, will share their perspectives on what it takes to move toward a ROC model in large, complex organizations.
They will discuss: Attendees will gain an inside look at how forward-thinking CISOs are approaching the journey toward a Risk Operations Center and the lessons they’ve learned along the way.
Security teams can no longer afford to chase endless alerts in a reactive cycle of patching and firefighting as threats multiply and regulatory pressures mount.
The future of cybersecurity lies in operationalizing risk. The Risk Operations Center (ROC) represents a new paradigm—bringing together security signals, business context, and automation to drive measurable, continuous risk reduction.
In this session, we’ll explore how Enterprise TruRisk Management (ETM) enables organizations to shift from tactical firefighting to strategic risk management. Attendees will learn how to prioritize exposures that truly matter, translate cyber risk into business terms, and make faster, more confident decisions that strengthen both security and resilience.
