Ask a CISO what their organization’s biggest security risks are, and they can probably give you a list. Ask how much those risks have changed since last week or whether the company’s overall risk exposure aligns to its risk tolerance, and the answers become harder to pin down.
Most companies still rely on annual risk assessments to identify risks and develop treatment plans, with owners assigned to oversee remediation. By the time that process is complete, new vulnerabilities have emerged and business priorities have shifted, leaving security leaders with a snapshot of risk that quickly becomes outdated.
AI is adding pressure to an already difficult process. As organizations introduce AI into their everyday operations, security teams are responsible for understanding the new risks these tools create and ensuring they’re properly managed. Yet governance processes aren’t keeping pace. Deloitte research found that only 21% of companies have mature governance models for agentic AI, highlighting the growing gap between adoption and oversight.
At Appfire, we’ve encountered similar challenges. We identified risks and developed treatment plans, but understanding our exposure on a given day and whether mitigation efforts were progressing successfully remained difficult.
The Gap Between Identifying Risk and Addressing It
Security teams have become very good at finding problems. Wiz and Snyk can surface vulnerabilities across cloud environments and source code, often producing more findings than teams have the resources to address. The challenge is determining which findings pose the greatest risk to the business, prioritizing those that need immediate attention, and ensuring the right teams are taking action.
Another common issue is how organizations define risk. Security teams often identify weaknesses in their existing controls as risks without fully considering the actual risk those controls are addressing to prevent compromise. A weak password, for example, is a control failure. The actual risk is that someone could gain unauthorized access to a system, resulting in data loss. Understanding that distinction helps teams assess business impact and determine which risks need to be addressed first.
Appfire, like many others, experienced this issue with findings from different security systems that were difficult to consolidate, making it harder to track remediation without constant follow-up. We’d sometimes check back a month or quarter later to find that little progress had been made, because other departments had already allocated their resources.
Identifying a risk means little if the teams responsible for reducing the risk can’t or don’t act. The longer that work sits unresolved, the longer the business remains exposed.
Bringing Risk Management Into the Work Itself
These frustrations eventually led us to develop Appfire LiveRisk, a solution shaped by our security team’s experience managing risk across the business.
Building risk management directly into Jira was an important decision. Previously, identifying a risk, developing a treatment plan, and assigning remediation work involved disconnected systems and manual follow-up. Integrating these processes into Jira, where our teams already work, gives us greater visibility into risk ownership and mitigation progress.
We also saw an opportunity to use AI to address some of the time-consuming parts of the process. AI helps evaluate findings and uses that to express actual risk statements, often based solely on identified control weaknesses. It then assists in assigning risk levels based on impact and probability, and uses that information to prioritize risk treatment plans. Risk owners then review and refine those recommendations, acting a human-in-the-loop, before approving the work.
In addition, when a security tool confirms that a vulnerability has been addressed as a part of a risk treatment plan, that information should feed back into risk reporting so leadership can understand when remediation efforts are actually addressing overall risk.
For us, the ability to cross connect risk oriented processes improved risk visibility, while changing our understanding of risk and allowing us to adjust dynamically to changes in our risk posture.
Giving the Business a Clearer Picture of Risk
The major areas we focused on during development was reporting, including executive level reporting.
Throughout my career, reporting has been a consistent frustration with risk management platforms. Dashboards might show an overall risk score, but understanding what’s behind that number often requires digging through separate systems. We wanted to see how risk was changing and what was driving those changes.
Security leaders need to be able to track how risk changes over time and understand how their organization’s risk profile aligns with standards such as ISO 27001 and ISO 42001. This makes it easier to identify weaknesses and determine where resources are needed.
That visibility changes conversations with the board and executive leadership. I can explain our current risk posture, show where we stand against the organization’s risk appetite and demonstrate how remediation efforts are affecting our exposure.
It also changes how we work with other departments.
Consider an engineering leader preparing next year’s budget. Historically, security might raise urgent remediation requests after resources had already been allocated. With continuous risk visibility, CISOs can identify upcoming priorities earlier, explain why they matter and give teams time to incorporate that work into their plans.
That’s where continuous risk visibility becomes valuable beyond security. It gives teams the information they need to make decisions about their work, with a clearer understanding of how those decisions affect the business.
Risk Management Shouldn’t Stop Between Assessments
Annual risk assessments still have a place, but CISOs need a more current understanding of organizational exposure. CISOs should start by identifying where risk information is disconnected from the teams responsible for addressing it, then leverage existing processes to establish a way to track whether that work is reducing exposure against the risk appetite defined by leadership.
For me, the biggest change since implementing Appfire LiveRisk has been the ability to have more productive conversations across Appfire. I can prioritize high impact risks and show teams the risks they’re responsible for, the progress they’ve made, and what still needs attention. A risk assessment from nine months ago can tell you where the organization stood. As a CISO, I need to know where we stand today.
_______
About Doug Kersten
Doug Kersten is Chief Information Security Officer at Appfire, a leading global provider of enterprise apps connecting the world’s top platforms. At Appfire, Doug is responsible for maintaining effective information security and incident response programs and instilling a positive security culture. Doug was instrumental in launching Appfire’s award-winning Trust Center, which connects customers, partners, and prospects to the latest information on the security, privacy, and compliance of the company’s products and services. Under Doug’s leadership, Appfire received four internationally recognized cybersecurity certifications, including the International Organization for Standardization (ISO) 27001; ISO 27017; System and Organization controls (SOC) SOC 2, Type l; and SOC 2, Type II. Doug brings 20+ years of experience leading security and IT programs for some of the world’s top financial institutions and law firms. While working for the New York Stock Exchange, he assisted in the design and implementation of the first wireless trading network on the stock exchange floor and led information security risk committees in identifying and approving proposed risk mitigation strategies. Doug has also implemented comprehensive security programs at multiple organizations throughout his career and supported major equity investments and an IPO filing. He has a record of applying strategic planning and people leadership skills to drive business performance, with a focus on reducing friction, delivering value, and enhancing efficiency, including with sales velocity.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
