Charting the Risk and Regulation Maze

Charting the Risk and Regulation Maze

Speakers: Ugo Vignolo Lutati (CISO, Prada Group), Ira Winkler (CISO & VP, CYE), Dr. Hussain Aldawood (Director of Cybersecurity Consulting, EY), Prasanth Prasad (CTO, Spire Solutions), David Cass (CISO, Keyrock)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=2MX1TYVb4SE

Overview

In an era where the digital landscape evolves at an unprecedented pace, the intersection of cybersecurity risk, regulatory compliance, and organizational resilience has become a critical challenge for enterprises worldwide. The Black Hat MEA panel discussion, "Charting the Risk and Regulation Maze," brought together a distinguished group of global CISOs and CTOs to dissect these intricate dynamics. Moderated by David Cass, CISO at Keyrock, the panel featured Ugo Vignolo Lutati (CISO, Prada Group), Ira Winkler (CISO & VP, CYE), Dr. Hussain Aldawood (Director of Cybersecurity Consulting, EY), and Prasanth Prasad (CTO, Spire Solutions).

This expert panel delved into how organizations can navigate the escalating complexity of regulatory obligations while simultaneously fostering robust security postures and maintaining business agility. The discussion underscored the necessity of moving beyond a reactive, checklist-based approach to compliance, advocating instead for strategies that embed security and regulatory readiness into the very fabric of business operations. The insights shared are particularly pertinent for cybersecurity leaders grappling with the dual pressures of satisfying auditors and fending off sophisticated adversaries, all without impeding innovation or operational efficiency.

The talk addressed critical questions facing modern security executives: how to translate dense regulatory requirements into actionable priorities, adapt to rapidly changing compliance landscapes like NIS2 and emerging AI regulations, and effectively communicate cyber risk materiality to executive leadership and boards. By exploring innovative approaches to compliance, risk quantification, third-party management, and the integration of security into daily workflows, the panelists offered a pragmatic roadmap for building resilient organizations in a highly regulated and threat-laden environment.

Background

▶ Watch: Panel introduction: Charting the risk and regulation maze (0:00)

The contemporary cybersecurity landscape is characterized by an accelerating convergence of technological innovation, evolving threat actors, and a burgeoning wave of global regulations. As the panel highlighted, regulations are tightening worldwide, with significant legislative developments such as the Digital Operational Resilience Act (DORA), the EU AI Act, and the ubiquitous General Data Protection Regulation (GDPR) shaping the compliance agenda. A particularly impactful recent change cited by Ugo Vignolo Lutati is NIS2 (Network and Information Security Directive 2), which he views as a critical enforcer of cybersecurity compliance as a strategic organizational objective. This shift mandates a more formalized and proactive approach to security, even for industries not directly subject to it, like the fashion industry, which Prada Group leverages as a best practice framework.

Historically, compliance has often been perceived as a burdensome, checklist-driven activity, detached from core business strategy. This perception has led to a siloed approach, where legal, security, and engineering teams operate independently, resulting in inefficiencies, compliance fatigue, and a failure to translate regulatory mandates into genuine risk reduction. Ira Winkler articulated this common challenge by noting that "good cyber security is unfortunately a should in most organizations." The problem exists because, without external pressure, essential security measures are often deprioritized against more immediate business objectives. Regulations, however, transform these "shoulds" into "musts," providing CISOs with a powerful tool—a "proverbial hammer"—to secure necessary resources and executive buy-in for foundational security initiatives.

Furthermore, traditional risk management metrics, often focused on perimeter defense, vulnerability counts, or log volumes, are proving inadequate in demonstrating true organizational resilience to regulators. Prasanth Prasad emphasized this transition, highlighting a shift away from "perimeter-based counting systems" towards more resilience-based metrics. This evolution reflects a growing understanding that merely identifying threats or logging incidents does not equate to an organization's ability to withstand and recover from cyberattacks. The increasing prevalence of supply chain attacks, as noted by Ira Winkler in the context of NIS2, further underscores the urgent need for a more holistic and evidence-based approach to third-party risk management, moving beyond simple questionnaire-based assessments.

Key Findings

▶ Watch: Ira Winkler: Steering regulators and audit processes effectively (7:10)

The panel discussion brought forth several critical findings and paradigm shifts essential for navigating the modern risk and regulation maze:

• NIS2 as a Strategic Imperative: The NIS2 Directive was identified as a pivotal regulation, compelling organizations to elevate cybersecurity compliance from an operational task to a strategic objective. Ugo Vignolo Lutati emphasized its role in formalizing cybersecurity practices, urging even non-directly affected sectors to adopt its principles for enhanced resilience, transforming compliance from a stressor into a benefit.
• Regulations as an Enabler, Not Just a Burden: Ira Winkler presented a contrarian but pragmatic view: regulations, despite their administrative overhead, serve as a potent tool for CISOs. They transform "shoulds" (recommended security practices) into "musts" (mandatory requirements), effectively providing the leverage needed to secure budget, resources, and executive attention for critical cyber hygiene and security program enhancements.
• Shift to Resilience-Based Metrics: Prasanth Prasad highlighted a fundamental change in how regulators assess security. The focus is moving away from traditional perimeter-based metrics such as vulnerability counts, log volumes, or registered assets in a CMDB. Instead, there's a growing demand for resilience-based metrics, evidenced by robust backup and recovery plans, disaster recovery strategies, and continuous control validation, demonstrating an organization's actual ability to recover from incidents.
• Actionable Translation of Regulatory Requirements: Dr. Hussain Aldawood detailed an effective approach to translating dense regulatory language into actionable security priorities. This involves breaking down requirements into plain language, defining clear control statements (what, who, what "good" looks like), prioritizing based on business impact, risk, and urgency, and embedding these tasks directly into existing operational processes (engineering, security operations, governance, risk).
• Enhanced Third-Party Risk Management: The panel unanimously agreed on the critical evolution of third-party and supply chain risk oversight. The days of relying solely on questionnaire-based assessments are over. Regulators and auditors now expect continuous control validation and automated evidence gathering from suppliers, moving towards a model where organizations can verify the security posture of their vendors in real terms, a significant improvement driven by regulations like NIS2.
• Materiality in Business Context: The discussion on defining material risk underscored the need to articulate cyber risks in terms of tangible business impact, rather than technical jargon. Dr. Aldawood suggested using questions like "Could this stop operations?", "Could this create regulatory problems or financial penalties?", or "Could this damage trust, brand, or safety?" Ira Winkler further elaborated on the concept of cyber risk quantification (CRQ) to proactively assess the monetary value of potential losses, criticizing the current trend of over-reporting non-material incidents, which floods regulators and dilutes the impact of actual material events.

Technical Deep Dive

▶ Watch: Ira Winkler: Defining materiality and cyber risk quantification (17:15)

The panel provided several technical and strategic insights into operationalizing compliance and risk management. Dr. Hussain Aldawood detailed a practical method for translating complex regulatory requirements into tangible security actions. His approach involves deconstructing dense regulations into plain language, then formulating clear control statements that specify "what needs to be done," "who owns it," and "what good looks like." These controls are subsequently prioritized based on business impact, risk, and urgency, ensuring alignment with organizational objectives. Critically, these tasks are then embedded into existing operational processes across engineering, security operations, governance, and risk functions, making compliance an inherent part of daily business rather than an external imposition.

Prasanth Prasad elucidated the paradigm shift in metrics, moving from traditional perimeter-based measurements to resilience-focused indicators. Historically, organizations might have reported on the "counts of vulnerability," "volume of logs" generated by a Security Information and Event Management (SIEM) system, or the number of assets registered in a Configuration Management Database (CMDB). Today, regulators demand more evidence-based, resilience-centric metrics, such as the efficacy of backup and recovery plans and the robustness of disaster recovery strategies. This reflects a deeper understanding that true security lies in the ability to withstand and rapidly recover from cyber incidents, rather than merely preventing them.

Ira Winkler shared a tactical, almost "Obi-Wan Kenobi" approach to engaging with regulators. He advised CISOs to "steer the regulators" by subtly guiding their focus. This can involve proactively highlighting areas where the organization wishes to improve, allowing regulators to "discover" these points and include them in their reports. This strategy effectively turns regulatory findings into internal mandates, securing executive buy-in for initiatives the CISO already deems necessary. Furthermore, he noted that many junior auditors from major firms like the "Big Four" for SOC 2 assessments are often less experienced, creating an opportunity for CISOs to direct their attention to well-managed areas while diverting it from potential weaknesses.

Organizational alignment was a recurring theme. Ugo Vignolo Lutati emphasized the strategic partnership with the legal department, noting that in his organization, the Data Protection Officer (DPO) functionally reports to the CISO, fostering synergy on data governance and compliance. To ensure broader alignment, he described the establishment of a Cybersecurity Committee, which meets monthly and comprises key C-suite leaders including the CIO, Chief People Officer, Internal Audit, DPO, CTO, Procurement, and General Counsel. This cross-functional committee ensures all stakeholders are aligned on cybersecurity matters and can make collective, informed decisions.

To combat compliance fatigue, Ugo suggested a six-pronged strategy:

1. Harmonize frameworks: Strive for integrated compliance frameworks, though he noted a lack of comprehensive vendor tools for this, often necessitating custom solutions. The goal is to select regulations and map common risks and controls.
2. Culture and Communication: Articulate the "why" behind compliance to employees and executives, transforming it from a mandatory chore into an opportunity for organizational safety.
3. Embed compliance: Integrate compliance activities directly into existing daily operations and processes, making it a natural part of work.
4. Automate where possible: Leverage technology to streamline compliance tasks.
5. Preventive analysis and continuous monitoring: Proactively identify risks and continuously monitor security posture, extending this to third-party vendors.

The discussion also touched upon the critical challenge of securing AI and Large Language Model (LLM) deployments. Prasanth Prasad outlined two distinct architectural approaches for implementing guardrails:

1. For organizations building their own AI programs: Guardrails should be embedded at the platform and code level from the outset, rather than being bolted on later. This includes controls for inputs (data ingestion, trust of source, prompt security, allowed data access) and outputs (data hygiene, factual awareness, guardrails within the AI code itself).
2. For organizations consuming external AI/LLM services (e.g., ChatGPT, OpenAI): The focus shifts to external controls. This necessitates robust measures for prompt security, injection prevention, and data leakage prevention for sensitive information like Personally Identifiable Information (PII) or Protected Health Information (PHI). Prasad referenced ISO 4201, highlighting the need for controls against data leakage on open AI platforms, implying the need for strong Data Loss Prevention (DLP) and secure API integration strategies.

Finally, Ira Winkler underscored the importance of cyber risk quantification (CRQ) tools. These tools are vital for proactively assessing the potential monetary loss associated with cyber incidents, helping organizations understand the business value of assets and the financial impact of their compromise over time. This data is crucial for informing materiality decisions and strategic investment in security.

Demo / Proof of Concept

▶ Watch: Ugo Vignolo Lutati: Strategies to prevent compliance fatigue (20:10)

As this was a panel discussion bringing together industry experts to share insights and perspectives on complex challenges, it did not include a live demonstration or a proof of concept. The session focused on theoretical frameworks, strategic approaches, and practical advice derived from the panelists' extensive experience in cybersecurity leadership and regulatory engagement.

Defensive Implications

▶ Watch: David Cass: Cannot outsource accountability, final thoughts (27:40)

The insights from the "Charting the Risk and Regulation Maze" panel offer several crucial defensive implications for cybersecurity professionals and organizational leaders:

1. Proactive and Strategic Compliance: Defenders must shift from a reactive, audit-driven compliance mindset to a proactive and strategic approach. As Dr. Hussain Aldawood stated, the goal is to "stay ready, not get ready." This means embedding compliance requirements into daily operations and security programs from the outset, viewing them as opportunities to strengthen the security posture rather than mere obligations.
2. Leverage Regulations for Budget and Prioritization: CISOs should embrace regulations as a powerful tool to advocate for resources and prioritize security initiatives. Ira Winkler's concept of using regulations as a "proverbial hammer" to turn "shoulds" into "musts" provides a clear strategy for securing necessary funding and executive buy-in for critical cyber hygiene and advanced security controls.
3. Prioritize Resilience Over Perimeter Defense: The shift towards resilience-based metrics necessitates a fundamental re-evaluation of security investments. Organizations must move beyond solely focusing on preventing breaches to building robust capabilities for rapid detection, containment, and recovery. This includes investing in mature backup and disaster recovery plans, incident response capabilities, and continuous monitoring to ensure operational continuity.
4. Implement Robust Third-Party Risk Management: Given the emphasis on supply chain security in regulations like NIS2, defenders must overhaul their third-party risk management programs. Moving beyond questionnaire-based assessments, organizations should implement continuous control validation and explore automated evidence-gathering mechanisms to gain real-time visibility into the security posture of their vendors. This helps prevent the transference of risk from suppliers to the organization.
5. Translate Technical Risk into Business Language: Effective communication of cyber risk to the board and executive leadership is paramount. Defenders must articulate the materiality of risks in terms of tangible business impacts, such as potential operational disruption, financial penalties, brand damage, or safety implications. Utilizing cyber risk quantification (CRQ) tools can provide data-driven insights to support these conversations and inform strategic decision-making.
6. Foster Cross-Functional Alignment: Breaking down silos between legal, security, compliance, and engineering teams is critical. Establishing a Cybersecurity Committee with diverse C-suite representation, as described by Ugo Vignolo Lutati, ensures that security is a shared responsibility and that decisions are made with a holistic understanding of regulatory, technical, and business implications.
7. Security by Design for AI/LLM: For organizations developing or extensively using AI and LLMs, embedding security guardrails at the architectural level is non-negotiable. Prasanth Prasad's guidance on designing controls for input validation (e.g., prompt security, data source trust) and output hygiene (e.g., factual awareness, data leakage prevention) ensures compliance and mitigates systemic risks from these emerging technologies. For external AI usage, robust Data Loss Prevention (DLP) and secure API integrations are essential to protect sensitive data.
8. Accountability Cannot Be Outsourced: As moderator David Cass reminded, while tasks can be outsourced, accountability remains with the organization. This means that even when leveraging third-party services or cloud providers, the ultimate responsibility for data protection and regulatory compliance rests with the client organization, necessitating rigorous oversight of outsourced functions.

Key Takeaways

Here are the key takeaways from the panel discussion, "Charting the Risk and Regulation Maze":

• Embrace Regulations as an Opportunity: View compliance not as a burden, but as a strategic enabler. Regulations like NIS2 provide the necessary leverage to secure budget and executive support for critical cybersecurity initiatives, transforming "shoulds" into "musts" for robust cyber hygiene.
• Shift to Resilience-Based Metrics: Move beyond traditional, perimeter-focused security metrics (e.g., vulnerability counts) to evidence-driven, resilience-based indicators that demonstrate an organization's actual ability to recover from cyber incidents, such as the effectiveness of backup and disaster recovery plans.
• Automate and Continuously Validate Third-Party Risk: Abandon questionnaire-based third-party assessments. Implement continuous control validation and automated evidence gathering to gain real-time insights into supply chain security, significantly reducing risk transference from vendors.
• Embed Security Guardrails in AI/LLM Architectures: For AI development, build security controls (e.g., prompt security, data hygiene) directly into the platform code. For external AI consumption, deploy robust external controls like data leakage prevention (DLP) and injection mitigation to protect sensitive information.
• Translate Risk into Business Outcomes: Communicate cyber risks to leadership in clear, non-technical business terms, focusing on potential impacts to operations, finances, brand, and safety. Utilize cyber risk quantification (CRQ) to provide tangible monetary values for potential losses.
• Stay Ready, Not Get Ready: Proactively integrate compliance requirements into daily security operations and processes. The goal is continuous readiness for audits and incidents, rather than a reactive scramble when an event occurs, ensuring an enhanced and sustainable security posture.

About the Speaker(s)

The panel "Charting the Risk and Regulation Maze" featured a diverse group of cybersecurity and technology leaders, each bringing unique perspectives from their extensive experience across various sectors:

• David Cass (CISO, Keyrock) served as the insightful moderator for the panel. With his background as a former banking regulator, he provided valuable context on regulatory expectations and emphasized the critical concept that organizations cannot outsource their accountability, even when outsourcing functions.
• Ugo Vignolo Lutati (CISO, Prada Group) offered a CISO's perspective from the luxury fashion industry. He highlighted the strategic importance of regulations like NIS2 in formalizing cybersecurity compliance and advocated for leveraging compliance as an opportunity to enhance organizational safety and secure budget, rather than viewing it as a mere obligation.
• Ira Winkler (CISO & VP, CYE), known for his pragmatic and often provocative insights, championed the idea of using regulations as a "proverbial hammer" to drive necessary security investments and turn "shoulds" into "musts." He also shared strategic approaches for CISOs to effectively manage and "steer" regulators.
• Dr. Hussain Aldawood (Director of Cybersecurity Consulting, EY) provided a consulting leader's viewpoint, focusing on practical methods for translating dense regulatory requirements into actionable security priorities. His approach emphasized breaking down complex mandates into plain language, defining clear control statements, and embedding compliance into existing business processes.
• Prasanth Prasad (CTO, Spire Solutions) brought a CTO's perspective, emphasizing the evolution of metrics from traditional perimeter-based measurements to resilience-based indicators. He also offered crucial guidance on architecting security guardrails for emerging technologies like AI and Large Language Models (LLMs), both for development and consumption.