Risk management
A successful risk management plan helps enterprises identify, plan for and mitigate potential risks. Learn about the components of risk management programs, including penetration tests, vulnerability and risk assessments, frameworks, security awareness training and more.
Top Stories
-
Tip
29 Oct 2025
How to write an information security policy, plus templates
Faced with multiplying security threats and complex IT environments, companies need comprehensive policies that detail how they will protect their systems and respond to attacks. Continue Reading
-
Quiz
22 Oct 2025
Cybersecurity awareness quiz: Questions and answers
From phishing to patching, file sharing to MFA, find out how much you know about preventing cybersecurity incidents in this security awareness training quiz. Continue Reading
-
Feature
20 Oct 2025
Salesforce breach: What IT leaders must know
A sophisticated attack on Salesforce users in October 2025 exposes vulnerabilities in SaaS ecosystems, forcing IT leaders to act on data, access and third-party risks. Continue Reading
-
Tip
09 Oct 2025
How CISOs can get out of security debt and why it matters
Like technical debt, security debt accumulates quickly, due to unpatched software, rushed security testing and poor visibility. When the bill comes due, it could mean a breach. Continue Reading
-
Tip
08 Oct 2025
What CISOs should know about DeepSeek cybersecurity risks
DeepSeek poses significant risks to U.S. enterprises -- even those that don't greenlight it for internal use. CISOs should take steps to reduce the threat. Continue Reading
-
Feature
30 Sep 2025
Bulletproof IT: How CIOs safeguard the tech supply chain
As geopolitical tensions threaten IT supply chains, CIOs can diversify hardware, prioritize AI workloads and build redundancy. Continue Reading
-
News
26 Sep 2025
News brief: AI cybersecurity worries mount
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Tip
10 Sep 2025
CISO's guide to security vendor consolidation
Organizations adopt a multitude of disparate security tools over time, which often results in tool overlap and added complexity for protecting systems and data. Continue Reading
-
News
05 Sep 2025
News brief: U.S. Cyber Trust Mark update and how to prepare
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Tip
04 Sep 2025
Cyber Trust Mark certification and how IoT devices will qualify
The U.S. Cyber Trust Mark aims to validate IoT devices that meet a certain security threshold. Explore key NIST recommendations informing certification requirements. Continue Reading
-
Tip
22 Aug 2025
Red vs. blue vs. purple team: What are the differences?
Red teams attack, blue teams defend and purple teams facilitate collaboration. Together, they strengthen cybersecurity through simulated exercises and knowledge sharing. Continue Reading
-
News
22 Aug 2025
News brief: Safeguards emerge to address security for AI
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Definition
13 Aug 2025
What is governance, risk and compliance (GRC)?
Governance, risk and compliance (GRC) refers to an organization's strategy, or framework, for handling the interdependencies of the following three components: corporate governance policies, enterprise risk management programs, and regulatory and company compliance. Continue Reading
-
Definition
08 Aug 2025
What is the three lines model and what is its purpose?
The three lines model is a risk management approach to help organizations identify and manage risks effectively by creating three distinct lines of defense. Continue Reading
-
Feature
08 Aug 2025
Experts weigh in on securing AI effectively
Using AI comes with security risks. Learn what the top attack vectors and privacy threats are, then discover how to mitigate them through proper strategy, monitoring and more. Continue Reading
-
Definition
07 Aug 2025
What is integrated risk management (IRM)?
Integrated risk management (IRM) is a set of proactive, businesswide practices that contribute to an organization's security, risk tolerance profile and strategic decisions. Continue Reading
-
News
07 Aug 2025
Credit Karma leader shares AI governance lessons learned
Start slow and break things -- that's how the head of data and AI at the fintech says enterprises should start building AI governance frameworks. Continue Reading
-
Definition
06 Aug 2025
What is enterprise risk management (ERM)?
Enterprise risk management (ERM) is the process of planning, organizing, directing and controlling the activities of an organization to minimize the harmful effects of risk on its capital and earnings. Continue Reading
-
Feature
06 Aug 2025
Malware vs. ransomware: What's the difference?
Ransomware is malware, but malware isn't always ransomware. It can be confusing, and the terms are sometimes used interchangeably, but the threats have distinct characteristics. Continue Reading
-
Video
05 Aug 2025
AI security: Top experts weigh in on the why and how
AI is everywhere, so security focus on this new technology is essential. In this podcast episode, three top security experts review the risks and discuss ways to mitigate them. Continue Reading
-
Tip
05 Aug 2025
8 ways to enhance data center physical security
Data center physical security is just as important as cybersecurity. Organizations can follow these eight security approaches to enhance facility access monitoring. Continue Reading
-
Opinion
01 Aug 2025
Black Hat 2025: Navigating AI and supply chain security
Experts at the conference will discuss how AI impacts software supply chain security, highlighting challenges and strategies for developers and security teams. Continue Reading
-
Feature
01 Aug 2025
Risk assessment matrix: Free template and usage guide
A risk assessment matrix identifies issues with the greatest potential for business disruption or damage. Use our free template to prioritize risk management plans. Continue Reading
-
Tip
31 Jul 2025
How to remove ransomware, step by step
Prevention is the best weapon against a ransomware infection. But in the event of compromise, consider these responses to contain and remove ransomware. Continue Reading
-
Feature
30 Jul 2025
9 common risk management failures and how to avoid them
As enterprises rework their business models and strategies to meet various new challenges, risks abound. Here are nine risk management failures to look out for. Continue Reading
-
Feature
29 Jul 2025
Traditional vs. enterprise risk management: How do they differ?
Traditional risk management and enterprise risk management are similar in their aim to mitigate risks that can harm a company. But there are differences between them. Continue Reading
-
Feature
28 Jul 2025
Top enterprise risk management certifications to consider
Certifications are essential to many careers. Here are some useful enterprise risk management certifications for risk managers, IT professionals and other workers. Continue Reading
-
Video
24 Jul 2025
An explanation of risk management for businesses
Risk management transforms uncertainty into opportunity by identifying threats, evaluating impacts and implementing strategic controls to protect and enhance business value. Continue Reading
-
Feature
23 Jul 2025
ISO 31000 vs. COSO: Comparing risk management standards
ISO 31000 and the COSO ERM framework are the two most popular risk management standards. Here's what they include and some of their similarities and differences. Continue Reading
-
Tip
21 Jul 2025
Risk prediction models: How they work and their benefits
Accurate risk prediction models can aid risk management efforts in organizations. Here's a look at how risk models work and the business benefits they provide. Continue Reading
-
Tip
18 Jul 2025
How to create a risk management plan: Template, key steps
A risk management plan provides a framework for managing business risks. Here's what it includes and how to develop one, plus a downloadable plan template. Continue Reading
-
News
17 Jul 2025
Rethinking cyber-risk as traditional models fall short
Systemic cyber-risk models are not accounting for rapidly evolving threats -- and a time when organizations are more interconnected than ever. Continue Reading
-
Tip
15 Jul 2025
AI in risk management: Top benefits and challenges explained
AI can improve the speed and effectiveness of risk management efforts. Here are the potential benefits, use cases and challenges your organization needs to know about. Continue Reading
-
Definition
15 Jul 2025
What is supply chain risk management (SCRM)?
Supply chain risk management (SCRM) is the coordinated efforts of an organization to help identify, monitor, detect and mitigate threats to supply chain continuity and profitability. Continue Reading
-
Definition
15 Jul 2025
What is cloud infrastructure entitlement management (CIEM)?
Cloud infrastructure entitlement management (CIEM) is a modern cloud security discipline for managing identities and privileges in cloud environments. Continue Reading
-
Tip
11 Jul 2025
How to build a cybersecurity culture across your business
As a company's cyber-risks evolve, so must its culture. Follow these tips to create a strong cybersecurity culture that helps protect your organization from cyberthreats. Continue Reading
-
Tip
10 Jul 2025
What CISOs need to know about AI governance frameworks
AI offers business benefits but poses legal, ethical and reputational risks. Governance programs manage these risks while ensuring responsible use and regulatory compliance. Continue Reading
-
Tip
09 Jul 2025
Security log management tips and best practices
Learn how to conduct security log management that provides visibility into IT infrastructure activities and traffic, improves troubleshooting and prevents service disruptions. Continue Reading
-
Definition
09 Jul 2025
What is a CISO as a service (CISOaaS)?
CISO as a service, or CISOaaS, is the outsourcing of CISO (chief information security officer) and information security leadership responsibilities to a third-party provider. Continue Reading
-
Tip
09 Jul 2025
How to perform a cybersecurity risk assessment in 5 steps
When assessing cybersecurity risk, be sure to consider the scope of the project, your organization's specific assets and leadership's tolerance for risk. Continue Reading
-
Feature
07 Jul 2025
12 top enterprise risk management trends in 2025
Trends reshaping risk management include use of GRC platforms, risk maturity models, risk appetite statements and AI tools, plus the need to manage AI risks. Continue Reading
-
Feature
07 Jul 2025
What is the future of cybersecurity?
As cyberthreats grow more sophisticated, enterprises face mounting challenges. What does the future of cybersecurity hold, and how can organizations stay ahead? Continue Reading
-
Definition
02 Jul 2025
What is post-quantum cryptography? Comprehensive guide
Post-quantum cryptography, also known as quantum encryption or PQC, is the development of cryptographic systems for classical computers that can prevent attacks launched by quantum computers. Continue Reading
-
Definition
02 Jul 2025
What is the principle of least privilege (POLP)?
The principle of least privilege (POLP) is a concept in computer security that limits users' access rights to only what is strictly required to do their jobs. Continue Reading
-
Tip
02 Jul 2025
How to build a cybersecurity strategy and plan in 4 steps
A cybersecurity strategy isn't meant to be perfect, but this high-level plan must be proactive, effective, actively supported and evolving. Here are four key steps to get there. Continue Reading
-
Definition
01 Jul 2025
What is risk analysis?
Risk analysis is the process of identifying and analyzing potential issues that could negatively affect key business initiatives or projects. Continue Reading
-
Tip
01 Jul 2025
How to implement a risk-based security strategy: 5 steps
Making the move from compliance-based to risk-based security helps organizations prioritize threats using systematic assessment and strategic planning. Continue Reading
-
Definition
01 Jul 2025
What is risk management? Importance, benefits and guide
Risk management is the process of identifying, assessing and controlling threats to an organization's capital, operations and financial performance. Continue Reading
-
Definition
30 Jun 2025
What is the ISO 31000 Risk Management standard?
The ISO 31000 Risk Management framework is an international standard that provides organizations with guidelines and principles for risk management. Continue Reading
-
Video
30 Jun 2025
Ransomware: Examples, prevention and mitigating the damage
Top cybersecurity experts gathered to discuss the latest threats from ransomware and how organizations, large and small, can prevent or, at least, mitigate an attack. Continue Reading
-
Tip
30 Jun 2025
What is attack surface management? Guide for organizations
Attack surface management can help CISOs and other cybersecurity managers address the growth in the number of potential entry points threat actors might exploit. Continue Reading
-
Tip
30 Jun 2025
Cybersecurity outsourcing: Strategies, benefits and risks
For companies battling data breaches and cyberattacks, MSSPs can offer lower costs, better reliability, broader experience and more -- if organizations define their needs well. Continue Reading
-
Definition
30 Jun 2025
What is vulnerability management? Definition, process and strategy
Vulnerability management is the process of identifying, assessing, remediating and mitigating security vulnerabilities in software and computer systems. Continue Reading
-
Feature
30 Jun 2025
Enterprise cybersecurity: A strategic guide for CISOs
CISOs and others responsible for safeguarding an organization's systems, networks and data need to manage day-to-day threats while also planning strategically for what's ahead. Continue Reading
-
Feature
30 Jun 2025
Why effective cybersecurity is important for businesses
Cyberattacks can have serious financial and business consequences for companies, which makes implementing strong cybersecurity protections a critical step. Continue Reading
-
Tip
27 Jun 2025
Cybersecurity in M&A due diligence: Best practices for executives
Companies wouldn't think of merging with another organization without performing financial or business due diligence. The same is true of cybersecurity. Continue Reading
-
Tip
27 Jun 2025
How to build a cybersecurity RFP
Crafting a cybersecurity RFP requires clear goals, precise questions and vendor vetting. Follow these guidelines to streamline the process and meet your company's security needs. Continue Reading
-
Tip
27 Jun 2025
Cybersecurity skills gap: Why it exists and how to address it
The cybersecurity skills shortage is putting enterprises at risk. Worse, it shows no sign of abating. Here is why it's happening and what employers can do to mitigate the problem. Continue Reading
-
Tip
26 Jun 2025
Cyber insurance trends 2025: What executives need to know
Cyber insurance is essential for protecting an organization from the financial impact of a cyberattack and is a critical part of a risk management strategy. Continue Reading
-
Tip
26 Jun 2025
Generative AI security risks: Best practices for enterprises
Despite its benefits, generative AI poses numerous -- and potentially costly -- security challenges for companies. Review possible threats and best practices to mitigate risks. Continue Reading
-
Tip
25 Jun 2025
Ransomware threat actors today and how to thwart them
Top experts convened on BrightTALK's 'CISO Insights' to discuss 'Ransomware 3.0' -- the current threat and what organizations, large and small, must do to thwart these bad actors. Continue Reading
-
Definition
25 Jun 2025
What is Single Sign-On (SSO)? Definition, How It Works & Benefits
Single sign-on (SSO) is a session and user authentication service that lets users access multiple applications or systems with a single set of login credentials. Continue Reading
-
Tip
25 Jun 2025
10 remote work cybersecurity risks and how to prevent them
Larger attack surfaces, limited oversight of data use, AI-driven attacks and vulnerable enterprise technologies are among the security risks faced in remote work environments. Continue Reading
-
Tip
24 Jun 2025
Cybersecurity governance: A guide for businesses to follow
Cybersecurity governance is now critical, with NIST CSF 2.0 recently adding it as a dedicated function. Learn why governance is core to an effective cyber strategy. Continue Reading
-
Definition
24 Jun 2025
What is risk avoidance?
Risk avoidance is the elimination of hazards, activities and exposures that can negatively affect an organization and its assets. Continue Reading
-
Definition
23 Jun 2025
What is pure risk?
Pure risk refers to risks that are beyond human control and result in a loss or no loss, with no possibility of financial gain. Continue Reading
-
Definition
23 Jun 2025
What is residual risk? How is it different from inherent risk?
Residual risk is the risk that remains after efforts to identify and eliminate some or all types of risk have been made. Continue Reading
-
Tip
23 Jun 2025
How to choose a cybersecurity vendor: 12 key criteria
Choosing a cybersecurity vendor entails a two-phase approach: shortlisting vendors using clear requirements, then conducting thorough evaluations based on key criteria. Here's how. Continue Reading
-
Definition
20 Jun 2025
What is the Risk Management Framework (RMF)?
The Risk Management Framework (RMF) is a template and guideline organizations use to identify, eliminate and minimize risks. Continue Reading
-
Definition
20 Jun 2025
What is risk assessment?
Risk assessment is the process of identifying hazards that could negatively affect an organization's ability to conduct business. Continue Reading
-
Definition
18 Jun 2025
What is an attack surface? Examples and best practices
An attack surface is the total number of possible entry points and attack vectors an organization or system has that are susceptible to unauthorized access. Continue Reading
-
Definition
16 Jun 2025
What is operational risk?
Operational risk is the risk of losses caused by flawed or failed processes, policies, systems, people or events that disrupt business operations. Continue Reading
-
Tip
13 Jun 2025
How to write a risk appetite statement: Template, examples
A risk appetite statement defines acceptable risk levels for an organization. Here's what it includes and how to create one, with examples and a downloadable template. Continue Reading
-
Tip
13 Jun 2025
CISO's guide to building a strong cyber-resilience strategy
Cyber-resilience strategies that integrate BCDR, incident response and cybersecurity enable CISOs to build frameworks that help their organizations effectively handle cyberattacks. Continue Reading
-
Definition
11 Jun 2025
What is ransomware as a service (RaaS)?
Ransomware as a service (RaaS) is a subscription-based business model that enables threat actors, also called affiliates, to launch ransomware attacks by accessing and using predeveloped ransomware tools. Continue Reading
-
Definition
10 Jun 2025
What is a risk management specialist, and what does one do?
A risk management specialist is a role appointed within organizations to identify potential risks that might negatively affect the business. Continue Reading
-
Definition
05 Jun 2025
What is third-party risk management (TPRM)?
Third-party risk management (TPRM) is a comprehensive framework for identifying, assessing, and mitigating risks associated with using external vendors, suppliers, partners and service providers. Continue Reading
-
Feature
05 Jun 2025
Top 5 steps in the risk management process
Implementing an effective risk management process is a key part of managing business risks. Follow these five steps to ensure a successful process. Continue Reading
-
Tip
04 Jun 2025
A guide to risk registers: Benefits and examples
Risk registers document, prioritize and track an organization's risks, providing a holistic view of the risks and a ready way to communicate risk strategies. Continue Reading
-
Definition
03 Jun 2025
What is a chief risk officer (CRO)? A detailed CRO job description
The chief risk officer (CRO) is a senior executive tasked with assessing, overseeing and mitigating an organization's risks. Continue Reading
-
Feature
02 Jun 2025
Risk maturity model: How it works and how to use one
Explore risk maturity models and assessment tools for enhancing enterprise risk management. Improve ERM programs to mitigate risk and gain a competitive edge. Continue Reading
-
Definition
30 May 2025
What is security?
Security for information technology (IT) refers to the methods, tools and personnel used to defend an organization's digital assets. Continue Reading
-
News
30 May 2025
News brief: Week's top breaches stem from third-party attacks
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Tip
30 May 2025
Key steps to developing a healthy risk culture
Some companies fail to communicate that risk is every employee's business. For others, top leadership is the impediment. Here's how to build a strong risk culture. Continue Reading
-
Definition
30 May 2025
What is fourth-party risk management (FPRM)?
Fourth-party risk management (FPRM) is the process of identifying, assessing and mitigating risks that originate from the subcontractors and service providers that an organization's third-party vendors use. Continue Reading
-
Feature
30 May 2025
13 types of business risks for companies to manage
Knowing the types of risks businesses commonly face and their applicability to your company is a first step toward effective risk management. Continue Reading
-
Definition
28 May 2025
What is a compliance framework?
A compliance framework is a structured set of guidelines that details an organization's processes for maintaining accordance with established regulations, specifications or legislation. Continue Reading
-
Definition
28 May 2025
What is a risk manager? Roles and responsibilities
A risk manager is a professional responsible for identifying and mitigating dangers to an organization's operations, reputation, safety, security and financial health -- any aspect with a potential negative impact on the company. Continue Reading
-
Feature
22 May 2025
Risk appetite vs. risk tolerance: How are they different?
Risk appetite and risk tolerance are related, but they don’t mean the same thing. Not knowing the difference can cause big problems for your risk management program. Continue Reading
-
Tip
20 May 2025
Best practices for board-level cybersecurity oversight
Corporate boards must play an increasingly active role in overseeing cybersecurity strategies. Here's what they need to know, from SEC disclosure requirements to best practices. Continue Reading
-
Definition
16 May 2025
What is risk appetite?
Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value. Continue Reading
-
Definition
14 May 2025
What is business resilience?
Business resilience is an organization's ability to adapt quickly to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Continue Reading
-
Definition
14 May 2025
What is penetration testing?
A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading
-
Definition
09 May 2025
What is a risk profile? Definition, examples and types
A risk profile is a quantitative analysis of the types of threats an organization, asset, project or individual faces. Continue Reading
-
Definition
09 May 2025
What is risk reporting?
Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes. Continue Reading
-
Definition
09 May 2025
What is the Sarbanes-Oxley Act? Definition and summary
The Sarbanes-Oxley Act of 2002 (SOX) is a federal law that established sweeping auditing and financial regulations for public companies. Continue Reading
-
Feature
07 May 2025
Enterprise risk management team: Roles and responsibilities
Every facet of business operations is exposed to risks, requiring a risk management team that's composed of a diverse mix of corporate executives and managers. Continue Reading
-
News
06 May 2025
The dark side of digital: Breaking the silence on youth mental health
Industry experts at RSAC 2025 called for urgent accountability in addressing technology's negative impact on youth, highlighting concerns about internet anonymity, mental health and the growing disconnect between generations. Continue Reading
-
Definition
28 Apr 2025
What is a risk map (risk heat map)?
A risk map, or risk heat map, is a data visualization tool for communicating specific risks an organization faces. Continue Reading
-
Opinion
25 Apr 2025
RSAC 2025 to center on agentic AI, GenAI in security
If AI continues to become more accurate and secure, automation and self-healing systems that strengthen security programs could be the future. Continue Reading
-
Tip
24 Apr 2025
How to incorporate smishing into security awareness training
Smishing is a major threat on enterprise smartphones, but users might not know how it compares to traditional email phishing. IT can help block attacks with training and testing. Continue Reading
-
Definition
23 Apr 2025
What is ransomware? Definition and complete guide
Ransomware is malware that locks and encrypts a victim's data, files, devices or systems, rendering them inaccessible and unusable until the attacker receives a ransom payment. Continue Reading