About me and three of my favorite heuristics for cybersecurity

Hi, I'm Bill Frank, and RiskPundit is my company. I've been doing cybersecurity for over 25 years. 

With the rise of Generative and especially Agentic AI, rationalizing control investments has become even more important, as attack surfaces are growing much faster than cybersecurity budgets. 

Before I shifted to "risk management" in 2019, I focused on EDR. Before that, next-gen firewalls. And my first ten years in cybersecurity was all about SIEM.

The term, "risk management" has gotten a bad wrap over the years as merely a compliance checkbox. But done right, i.e., by treating cyber risk as business risk, it can drive an organization's cybersecurity program.

I think of cyber risk management as "Moneyball" for cybersecurity. So risk is the probability of material cyber-related loss events. By material, I mean the loss events of concern to business leaders.

So I'm focused on helping security leaders and their teams with budget-allocation decisions to prioritize and justify "control" investments. By controls I mean the combination of people, processes, and technologies. 

My focus on risk management natually extended to compliance. So I've worked through the "compliance requirements/security needs" tension that security teams regularly deal with. 

Below, I highlight three heuristics that have helped me over the years. Maybe you'll find them useful, too.

If you're looking for a more resume-like background, click the button below to visit my LinkedIn page.