Risk Management: Page

News brief: Gartner Security and Risk Management Summit recap

Check out the latest security news from the Informa TechTarget team.

By Staff report • June 13, 2025

What is cyber risk quantification (CRQ)? How to get it right

Cyber risk quantification translates security threats into financial terms, so executives can prioritize risks, justify investments and allocate resources to protect the business.

By Stephen Bigelow • June 13, 2025

What a smart contract audit is, and how to conduct one

Smart contracts ensure the integrity of transactions, such as those that initiate key services. A smart contract audit is one way to ensure the programs work as designed.

By Paul Kirvan • June 13, 2025

What is a chief risk officer (CRO)? A detailed CRO job description

The chief risk officer (CRO) is a senior executive tasked with assessing, overseeing and mitigating an organization's risks.

By Kinza Yasar, Mary Pratt, Ben Cole • June 3, 2025

What is security?

Security for information technology (IT) refers to the methods, tools and personnel used to defend an organization's digital assets.

By Madelyn Bacon, Nick Barney • May 30, 2025

What is a passkey?

A passkey is an alternative user authentication method that eliminates the need for usernames and passwords.

By Amanda Stevens, Mary Shacklett • May 21, 2025

What is risk appetite?

Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value.

By Alexander Gillis • May 16, 2025

What is a risk profile? Definition, examples and types

A risk profile is a quantitative analysis of the types of threats an organization, asset, project or individual faces.

By Mary Pratt • May 9, 2025

What is risk reporting?

Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes.

By Brien Posey • May 9, 2025

How to spot and expose fraudulent North Korean IT workers

North Koreans have infiltrated countless U.S. companies as remote IT workers. That means your top developer could also work for one of the world's most notorious dictators.

By Alissa Irei • May 8, 2025

What is a risk map (risk heat map)?

A risk map, or risk heat map, is a data visualization tool for communicating specific risks an organization faces.

By Mekhala Roy, Mary Pratt • April 28, 2025

7 stages of the ransomware lifecycle

It can be nearly impossible to predict if or how a ransomware group will target an organization, but there are knowable stages of a ransomware attack.

By Char Sample , Andrew Froehlich • April 28, 2025

What is risk exposure in business?

Risk exposure is the quantified potential loss from currently underway or planned business activities.

By Ben Cole, Dave Shackleford • April 24, 2025

Tips to find cyber insurance coverage in 2025

Most businesses have a form of cyber insurance, either through cyber liability and data breach endorsements in traditional business policies or through standalone cyber policies.

By Kathleen Richards • April 17, 2025

How to conduct ransomware awareness training for employees

As your organization's first line of defense, hold regular employee training on how to prevent, detect and respond to ransomware attacks.

By Sharon Shea • April 14, 2025

The top 5 most secure encrypted messaging apps

Secure messaging uses end-to-end encryption, decentralized servers and open source code. The most secure messaging apps, such as Signal and Sessions, combine these features.

By Madeleine Streets • April 11, 2025

How to prevent and protect against ransomware

Organizations sometimes learn difficult lessons about gaps in their cybersecurity defenses. Here's what to know about ransomware preparation, detection, response and recovery.

By Dave Shackleford • April 9, 2025

Explaining AI’s impact on ransomware attacks and security

Experts say AI and LLMs will make ransomware attacks more dangerous, but those same tools could be turned against criminals by bolstering ransomware protections.

By Michael Nadeau • April 7, 2025

How to avoid and prevent social engineering attacks

Organizations and employees must both do their part to prevent and avoid social engineering attacks. A combination of security controls, policies, procedures and training is necessary.

By Paul Kirvan • March 17, 2025

Top 14 open source penetration testing tools

From Aircrack-ng to ZAP, these open source penetration testing tools are essential additions to any security pro's toolbox.

By Ed Moyle • March 7, 2025

What is defense in depth?

Defense in depth is a cybersecurity strategy that uses multiple security measures to protect an organization's networks, systems and data.

By Kyle Johnson • Feb. 18, 2025

What is information security management system (ISMS)?

An information security management system (ISMS) is a set of policies and procedures for systematically managing an organization's sensitive data.

By Paul Kirvan , Kinza Yasar • Feb. 11, 2025

What is ISO 27001?

ISO 27001, formally known as ISO/IEC 27001:2022, is an information security standard jointly created by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

By Paul Kirvan, Katie Terrell Hanna • Feb. 10, 2025

How to create a third-party risk management policy

NIST's Cybersecurity Framework offers some helpful tips for organizations to fortify their third-party risk management strategies. Here's how to implement them.

By Matthew Smith • Feb. 5, 2025

What is threat modeling?

Threat modeling is the systematic process of identifying threats to and vulnerabilities in software applications, and then defining countermeasures to mitigate those threats and vulnerabilities to better protect business processes, networks, systems and data.

By Rahul Awati , Michael Cobb • Jan. 23, 2025