Security and Privacy Culture, Training and Awareness Questions

Session title: Risk-Based Security Decision Making for Executives (30 min)

Outline (minutes)

• 0–3 — Opening: objective, why risk-based decisions matter for posture & testing
• 3–8 — Core concepts: asset value, threat likelihood, impact, residual risk, controls
• 8–15 — Translation: how pentest findings map to business risk and ROI of fixes
• 15–25 — Interactive exercises (two scenarios, group decisions + debrief)
• 25–30 — Wrap-up: three takeaways, next steps, Q&A

Exercise 1 — Critical Asset Trade-off (10 min)

• Scenario: Prod API handles payments; pentest finds an RCE reachable via third-party library; patch causes 2-hour downtime window with potential revenue loss $X/hour.
• Activity: Execs choose: delay patch and apply compensating controls, schedule immediate downtime, or deploy hotfix with rollback plan. Each choice: list business risks, mitigation cost, expected residual risk.
• Debrief: pentester explains attack chain, exploitability, detection likelihood, and recommended prioritized fix path.

Exercise 2 — Vulnerability Prioritization Matrix (10 min)

• Scenario: Quarterly pentest yields 8 findings: 1 critical auth bypass, 2 high SQLi (internal), 3 medium info disclosure, 2 low XSS. Limited engineering bandwidth for 4 fixes this sprint.
• Activity: Teams rank fixes using asset value, exploitability, detection risk, and compliance consequences; justify selection to board.
• Debrief: show risk scoring rubric and how exploitability from pentest (POC, complexity) changes priority.

Three key takeaways

• Prioritize by business impact + exploitability: a high-impact but non-exploitable bug may be lower priority than a medium-impact, easily exploitable issue.
• Compensating controls and detection reduce risk quickly — patching isn’t the only answer.
• Ask for measurable risk metrics (time-to-exploit, confidence, expected loss) — decisions should be data-driven, not fear-driven.