Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Cyber Risk in the Boardroom

16 Jul 2026 · 1 min

Watch on YouTube

1:24

In this board‑level presentation, the speaker emphasizes the need for executives to balance rapid delivery with a comprehensive view of cyber risk. He urges board members to ask whether the organization has consulted supply‑chain and production teams, how cyber incidents could affect code releases or even non‑software, three‑dimensional products, and what mitigation steps are possible. He contrasts traditional siloed board briefings—where the CIO, CFO, and CISO speak separately—with a modern, integrated executive approach where teams coordinate and present unified plans. Drawing on his experience at Microsoft and Cisco, he introduces the Risk and Resiliency Operating Committee (RROC), a cross‑functional governance body that includes all relevant functions, even HR, to ensure equal stake, respect, and holistic risk management.

Chapters

At a board level, I always ask, you know, how are we balancing the speed with understanding the full spectrum of the risk? Did you go talk to the supply chain and the production people? Number one, right? Is this going to impact our ability to push out code? Is it if we are in an environment where we actually have, dare I say it, a three-dimensional product that is actually not software? How is it going to impact that? What can we do to mitigate that? And that's going to be a presentation that's almost a panel. So, the old-school thinking of the board was the CIO got up, the CFO got up, the CISO got up, and you all talked about things to the board members in isolation. And I can always tell when I have an integrated executive team if they rift off one another or if they had a plan. So, for me, We have entered the day and age where something that I had the privilege of leading and working on at both Microsoft and Cisco, and certainly still think about, is call it what you want. I called it the RROC, the Risk and Resiliency Operating Committee. That's what it's all about. And everybody sits at the table, even the HR people. So everybody gets an equal stake. Everybody gets equal respect.