In today’s fast-paced technological landscape, risk management has evolved from a reactive checklist to a strategic, holistic discipline essential for business continuity. Cyber risk and cloud security are no longer standalone IT problems; they are integral subsets of a broader Enterprise Risk Management (ERM) framework that dictates an organization’s ability to achieve its objectives.
We spoke with Amit Subhanje, Regional Risk Leader at GE Aerospace, who shared his expertise on navigating the complex world of cyber risk, the shift from traditional to enterprise risk management, and the crucial role of basic cyber hygiene and a strong risk culture.
You can read the complete transcript of the epiosde here >
What is Risk Management, and How Does it Apply to Cybersecurity?
Risk is defined as the uncertainty of an event that, if it occurs, would hamper the company achieving its objective. Risk function should be directly proportional to the business value.
Risk Management is a structured mechanism composed of four key steps:
- Identifying risk.
- Assessing risk.
- Monitoring risk.
- Mitigating risk.
The Cyber Security Connection
Cybersecurity and cloud security are subsets of risk management, meaning the methodology (identifying, assessing, monitoring, and mitigating) remains the same at a high level.
The goal of approaching cybersecurity from a risk management perspective is to ensure all cyber-related risks are brought within the risk appetite of the organization. Decisions regarding mitigation, like prioritizing open vulnerabilities, must be made based on this risk-based approach and the organization’s risk appetite.
What Unique Challenges Do Organizations Face in Managing Cyber Risk Today?
The cybersecurity landscape is constantly evolving, presenting organizations with several unique and accumulating challenges:
- Rapid Technology Evolution: Technologies are evolving at a very rapid pace, which means the process for understanding the risk for that technology must also change constantly.
- Talent Crunch: There is a challenge in having the right person at the right place at the right time. Specific roles, such as a technology auditor, require a specific acumen to properly understand and audit applications.
- Advanced Phishing: Phishing has become one of the hottest topics, with the use of AI helping anyone create a lot of phishing kind of scenarios that even organizations can’t detect.
- AI Risks: Organizations are struggling with AI risks from applications like ChatGPT. The hard fact is that a majority of organizations have employees who have downloaded this software, and currently, there is no foolproof solution to mitigate the AI risk.
How Can Organizations Proactively Address These Cyber Challenges?
Amit is a big fan of starting with the basics and focusing heavily on the human element of risk.
- Address Human Risk First: Approximately 90% of cyber attacks have human-related causes, as seen during root cause analysis. Implement the right training and awareness programs to address this.
- Enforce Basic Cyber Hygiene: The basic security elements are often overlooked but are fundamentally important. These include:
- Multi-Factor Authentication (MFA): A key component of Identity Access Management (IAM).
- Endpoint Detection and Response (EDR)/Antivirus.
- Host Intrusion Prevention Systems (HIPS).
- Data Loss Prevention (DLP).
- Tone from the Top and Funding: The success of any security program depends on having the tone from the top and ensuring the CISO’s team has the necessary funding to upskill the program year on year.
What is the Difference Between Traditional Risk Management and Enterprise Risk Management (ERM)?
Risk management and Enterprise Risk Management (ERM) are different, with ERM representing the evolved form of traditional risk management.
Traditional Risk Management
- Approach: Reactive. Mitigation action is taken only after an attack is faced.
- Scope: One-dimensional or non-holistic. Often limited to cyber and cloud risks.
- Coverage: Does not cover multiple aspects of risk.
Enterprise Risk Management (ERM)
- Approach: Proactive. Focuses on forecasting future coming risks, challenges, vulnerabilities, and threats.
- Scope: Holistic approach that provides the right picture to stakeholders and the board.
- Coverage: Cuts across the entire organization, covering political, environmental, social, technological, legal, and economic risks.
How Should a Fast-Growing Startup Build an ERM Framework?
For a startup transitioning to focus on enterprise risk management, the plan must start with culture and governance.
- Build the Right Risk Culture: This is the most important step; without it, there is no ERM. Risk culture involves all employees having a feeling of accountability for helping the organization mitigate risk.
- Define Risk Appetite: The organization needs to set the right risk appetite statement. It must be known to all the right stakeholders how much risk the organization can bear for risk-based decisions.
- Establish an ERM Committee: Form a committee with representation across the organization (IT, facilities, technical, physical security) because ERM is a holistic approach.
How Can Organizations Drive Security Awareness and Accountability?
Security awareness must be an ongoing, targeted program, moving away from being an annual compliance checklist.
Improving Awareness and Training
- Targeted Training: Comprehensive, generic training doesn’t help. Training must be catered to the specific group based on the language they understand. For an engineering team, the training should have a flavor of product security, software security, and the SDLC cycle.
- Effective Phishing Programs: Run multiple phishing scenarios every year—they cannot be the same. This is essential to check the effectiveness of the whole program.
- Encourage Incident Reporting: Organizations should want more incidents to be reported, not fewer, as this shows that the employees understand the training and are contributing back to the security function.
- Define Reporting Channels: Employees need to know where to report the risk or incident. Without clear reporting channels, all the training is useless.
- Understand Risk Trends: Monitor both internal trends (e.g., specific DLP issues increasing internally) and external trends (e.g., incidents in similar industries) to make training relevant and specific.
Fostering Accountability
- Demonstrate Real Impact: To make employees accountable, demonstrate real scenarios of internal incidents (where appropriate) so employees understand the impact their colleague’s actions had on the organization.
- Relate to External Incidents: If real internal incidents cannot be shared, use external incidents from competitors in a similar industry so people can relate to the potential consequences (e.g., reputation damage, data breaches).
- Shared Responsibility Mindset: Employees need to understand that security is their part of the job and they are securing their own company.
Reading Recommendation
Book: Split the Difference by Chris Voss. The book is about negotiations and handling high-stakes crises. It highlights the power of saying “no” and using the space between a “yes” and “no” to drive discussions and find a middle ground—a key skill for security practitioners in stakeholder management.
Conclusion: ERM as the Engine for Proactive Security
Amit Subhanje’s perspective positions Enterprise Risk Management (ERM) as the strategic engine driving all modern security efforts. The core shift is from traditional, reactive risk management to a proactive, holistic ERM framework that covers all threats—from technology to political instability.
For any organization, success in cybersecurity hinges on two fundamental actions: mastering the basics (MFA, EDR, cyber hygiene ) and fostering a culture of accountability. By establishing a clear risk appetite and communicating risk trends in a contextual, tailored way to employees , organizations transform security from a compliance checklist into a shared responsibility vital for achieving business objectives.
