Exposure Management: Stop Measuring Controls. Start Measuring Risk. – Heather Ceylan – CSP #229
The threat landscape is too massive to treat every vulnerability, control gap, and exposure as equally urgent. In this episode, Heather joins us to explore how exposure management is changing the way organizations prioritize and report cyber risk.
Instead of starting with control effectiveness, teams can begin with key risk indicators: What is actually exposed? What threats are real, tangible, and imminent? What could have the greatest business impact?
From there, organizations can tie those risks back to the controls designed to reduce them. It’s a shift from asking “Are our controls working?” to “Are we reducing the risks that matter most?”
Segment Resources: https://www.linkedin.com/pulse/from-green-dashboards-real-exposure-security-kri-framework-ceylan-ho2yc/
This is our final episode of the CISO Stories podcast. Thank you to host Jessica Hoffman, to creator & host Todd Fitzgerald, and most of all, to our audience for tuning in.
Heather Ceylan is the Chief Information Security Officer at Box, where she leads the global information security program and strategy. With over 15 years of experience, she has built and led high-performing security teams across technology, healthcare, and financial services—industries with some of the most rigorous regulatory environments. Prior to Box, she served as Deputy CISO at Zoom, where she helped scale the company’s security posture during a period of rapid global growth. She also held previous roles as the VP of Security, Privacy, and Compliance at Collective Health and a Director in PwC’s cybersecurity practice where she advised Fortune 500 companies on complex security and privacy programs. Recognized as the 2024 Women in Cybersecurity Leader of the Year, Heather is known for her pragmatic approach to building security programs that enable innovation while safeguarding trust.
