In last month’s CISO Series AMA on r/cybersecurity, we asked security leaders who’ve made the shift from compliance-driven to risk-based programs to share what actually works. The panel included:
- David Cross, (u/MrPKI), CISO, Atlassian
- Kendra Cooley, (u/infoseccouple_Kendra), senior director of information security and IT, Doppel
- Simon Goldsmith, (u/keepabluehead), CISO, OVO
- Tony Martin-Vegue, (u/xargsplease), executive fellow, Cyentia Institute
What emerged wasn’t a playbook for overnight transformation, but something more valuable: honest talk about when compliance frameworks are perfectly fine, where they break down, and what it actually means to manage risk instead of just tracking controls.
Start with what actually matters
“Identify the high-level system functions that are critical to the organisation’s mission (e.g. ‘product on shelves, taking customer payments’ rather than ‘the database’).” — Simon Goldsmith (u/keepabluehead)
Simon’s advice for organizations inheriting legacy systems: forget the asset inventory and focus on what the business actually needs to function. Define hard constraints like “service must not be unavailable for more than two hours” instead of fuzzy goals, then build feedback loops to see when things drift.
Risk registers that look like to-do lists aren’t risk management
“A genuine risk-based program starts when the questions change from ‘what controls are we missing?’ to ‘what are we choosing, and what are we choosing not to do?'” — Tony Martin-Vegue (u/xargsplease)
Tony drew a sharp line: risk management is about decision-making under uncertainty, not gap analysis with fancier language. If your risk assessment can’t help leadership make tradeoffs, you’re still running a compliance program—you’ve just relabeled it.
Don’t sell the math, sell the clarity
“Do not sell the heavy model. Sell the taxonomy, not the math. Use the logical structure of FAIR to decompose uncertainty and clarify your thinking, but skip the ‘heavy’ implementation unless it directly speeds up a high-leverage investment decision.” — Simon Goldsmith (u/keepabluehead)
Simon admitted he’s on “the mildly sceptical end” when it comes to FAIR, recommending teams use its structure to think clearly about uncertainty but skip complex implementations unless solving a specific decision problem. Simon positioned CRQ as business forecasting, not cybersecurity—the value isn’t precision, it’s forcing assumptions into the open.
The hardest part isn’t technical
“It takes patience and time to transition people to take ownership and to assess the risk… This is a cultural and technical framework transition that many organizations struggle with initially.” — David Cross (u/MrPKI)
David’s response was brief but clear: the cultural shift is the real work. Getting people to take ownership of evaluating risk takes time and patience.
Start small, or don’t start at all
“Start by using it for considering budgetary tradeoffs, and where risk can/should be accepted. The outcome of FAIR will only ever be as good as the effort put into determining the inputs—it is just a tool afterall. Garbage in = garbage out.” — Kendra Cooley (u/infoseccouple_Kendra)
Kendra’s advice for stretched teams: don’t pitch FAIR as a full replacement for existing tools. Start with specific use cases like budget decisions or risk acceptance conversations, where better inputs lead to better discussions.
The takeaway
The consensus from this panel wasn’t that compliance is bad or that every organization needs to quantify cyber risk in dollars. It was more nuanced: know what problem you’re actually solving. If a compliance framework gets you good outcomes, use it. If leadership needs help making tradeoffs under uncertainty, build a risk program they can understand and act on. And if you’re going to adopt something like FAIR, start small and focus on improving the quality of decisions, not just the sophistication of your models.
The shift from compliance to risk isn’t a destination—it’s a question of whether your security program is helping the business make better choices.
Want more insights from security leaders? Visit ciso-dev.davidspark.dcgws.com for podcasts, newsletters, and weekly live streams. Follow us for monthly AMAs at r/cybersecurity.
Join us again for our next Reddit AMA starting Sunday, January 25.
Our topic: “I had my budget cut and still reduced risk. Ask Me Anything.”