Ivanti Blog: Posts by

Understanding Risk Appetite – a Critical Component of Exposure Management

Mon, 10 Feb 2025 14:44:03 Z

Risk is inherent in any business. It’s how an organisation understands and manages it that makes all the difference.

From operational challenges to market volatility, regulatory changes and technological advancements, companies face a spectrum of uncertainties that could either generate growth or lead to losses.

To effectively manage them, a business needs to set out a framework that helps it determine just how much risk it’s willing to accept in pursuit of its objectives. This is where the concept of "risk appetite" comes into play.

But to define its risk appetite, a company has to see and understand all the risks it faces. And for security teams that are laying the groundwork for their exposure management strategy, defining their organisation’s risk appetite is a critical step.

What is risk appetite?

Risk appetite is the level of risk an organisation is willing to accept in pursuit of its objectives. Defining it sets boundaries for the organisation regarding what risks it will take and to what degree. A high risk appetite means being open to accepting greater risks for possibly higher rewards, while a low risk appetite means the organisation prefers reducing risk as much as possible.

Consider a tech startup that wants to invest in cutting-edge research and development. It may adopt a higher risk appetite to achieve disruptive, breakthrough innovations, knowing that the potential rewards are worth the uncertainty. Conversely, a large, well-established corporation might have a lower risk appetite, focusing on steady growth while avoiding projects that could significantly harm its market position or reputation.

Risk appetite is both quantitative and qualitative

Risk appetite is never static; it’s a dynamic measure that should be adjusted based on factors such as industry, company size and health, strategic objectives, regulatory requirements and the overall market environment.

Nor is it just about the numbers: risk appetite is a blend of both quantitative and qualitative factors.

On one hand, a business may have measurable elements like how much loss it’s willing to tolerate, its debt ratios and what kind of return on investment (ROI) it’s shooting for. It may also have subjective aspects to consider, such as the potential effect on company reputation, ethical considerations and how well its decisions align with its core values.

Why is it important to define risk appetite?

Nearly any organisation that wants to succeed has to take calculated risks. But without a clear understanding of its risk appetite, it can wander into inconsistent, reactive or overly cautious decision-making. That can lead to missed opportunities or business losses. Here's why defining risk appetite is essential:

To align strategy and risk management

Having a clearly defined risk appetite provides a strategic framework that aligns risk management practices with overall business goals. When an enterprise knows how much risk it is willing to accept, it can pursue opportunities that match its risk appetite while avoiding others that might expose it to undue risk.

To improve decision-making

Defining risk appetite allows leaders and managers to make informed decisions by clearly understanding what constitutes an acceptable risk. It also sets expectations for both risk-taking and risk-avoidance behaviours across the organisation, helping managers evaluate risk/reward trade-offs in different scenarios.

To build stakeholder confidence

A clearly defined risk appetite reassures investors, regulators, employees and other stakeholders that the organisation prioritises risk management. It also demonstrates a methodical, trustworthy approach to balancing risk against reward, further shoring up stakeholder confidence.

To promote consistency

When everyone in an organisation “gets the memo” on how much risk is permissible, that helps them make consistent decisions because they all understand what's an acceptable gamble. This means there’s less chance of working at cross-purposes or even pulling in opposite directions. For instance, a legal department might put the brakes on a marketing team’s Big Idea if they don’t share the same notion of acceptable risk.

To support effective risk monitoring

When companies define their risk appetite, they can set up systems to monitor risk levels across the entire enterprise, from finance to operations. Thus, they’re able to spot potential issues early and ensure activities stay within the boundaries of what’s seen as safe — or at least acceptable. Setting and monitoring key risk indicators (KRIs) provides early warnings if somebody is coming too close to those boundaries.

How does a company define its risk appetite?

Typically, an organisation does this by drafting a risk appetite statement (RAS). The first parts of an RAS lay out the company’s strategic objectives and the risks involved.

A company might want to become the leading software provider in their industry. They should list the strategic objectives that are vital to reaching that goal and also list the risks associated with them. For instance, Ivanti is in the business of delivering cloud-based IT services and security management solutions. That means it’s incumbent on us that our risk appetite statement catalogues all the risks involved in that line of business and explains how we’ll manage them.

Here’s an example of how one section of a risk appetite statement might look for a software provider:

General Risk Appetite

[Company XYZ] adopts a balanced approach to risk, recognising that not all risks are equal and that some level of risk is necessary to achieve our strategic goals.

Innovation Risk We have a high risk appetite for investing in advanced technologies and innovative solutions that differentiate our products in the competitive landscape. We understand this requires accepting a degree of uncertainty in R&D and product development.

Operational Risk We maintain a low to moderate risk appetite. While striving for operational excellence, we prioritise initiatives that improve efficiency and service quality without compromising our delivery standards.

Security Risk We have an extremely low risk appetite for security threats and breaches. Our commitment to network security and data protection is paramount, and we invest substantially in safeguarding our systems and our clients’ data.

Compliance Risk We have a low risk appetite for non-compliance with legal and regulatory requirements. Ensuring adherence to relevant laws, standards and best practices in all operational areas is critical.

General Risk Appetite [Company XYZ] adopts a balanced approach to risk, recognising that not all risks are equal and that some level of risk is necessary to achieve our strategic goals.
Innovation Risk	We have a high risk appetite for investing in advanced technologies and innovative solutions that differentiate our products in the competitive landscape. We understand this requires accepting a degree of uncertainty in R&D and product development.
Operational Risk	We maintain a low to moderate risk appetite. While striving for operational excellence, we prioritise initiatives that improve efficiency and service quality without compromising our delivery standards.
Security Risk	We have an extremely low risk appetite for security threats and breaches. Our commitment to network security and data protection is paramount, and we invest substantially in safeguarding our systems and our clients’ data.
Compliance Risk	We have a low risk appetite for non-compliance with legal and regulatory requirements. Ensuring adherence to relevant laws, standards and best practices in all operational areas is critical.

The RAS should define the risks that would have the greatest impact on the organisation, not everyday risks that are simply part of doing business. It ought to account for multiple risk scenarios; for instance, a specific strategy may entail supply chain risk, such as the effects of being locked into a vendor or the dangers of regulatory exposure if a supplier mishandles customer data.

It should also define the amount of financial risk a company is willing to take on. If its objectives include offering a new product or service, there's always a chance of failure in the marketplace.

Components of risk appetite

These are key factors that have to be considered in defining risk appetite:

Risk capacity

This refers to the maximum amount of risk that an organisation can bear. Financial resources, operational capabilities and regulatory constraints decide this. And risk capacity differs from risk appetite: an organisation may have the capacity to take on a certain level of risk but might choose not to, based on its risk appetite.

Risk tolerance

Whereas risk capacity is about how much risk an organisation can withstand, risk tolerance is an acceptable deviation from its target. It may even set different tolerances for different areas. For example, an organisation might be good with taking a chance on a new product, but risk-avoidant about managing customer data.

Risk thresholds

We’ve mentioned risk monitoring and KRIs above, as they’re used to keep a company from crossing risk thresholds — the “red lines” that represent too much risk. Crossing a risk threshold might require a change in plans, increased safety measures or even a complete halt to what they’re doing.

Related: Ivanti Research Report: Aligning Perspectives: Cyber Risk Management in the C-Suite

Why is risk appetite important in exposure management?

Once upon a time, mitigating digital risk was much simpler than it is today. That’s because most large organisations’ attack surfaces have vastly expanded over time. The addition of more devices and applications, used by employees in more places, have transformed the workplace and expanded the digital threat landscape.

It’s one reason why Ivanti research found that more than half of IT professionals are not very confident they can prevent a damaging security incident in the next 12 months. More than one in three even say they’re less prepared to detect threats and respond to incidents than they were a year ago.

Traditional vulnerability management has long been focused on reactively remediating software and hardware vulnerabilities and other CVEs, but usually only applies intermittent scans. But today’s cyberthreat scenario demands a new approach.

Modern exposure management is focused on continually, proactively finding and remediating risks and vulnerabilities across the entire digital attack surface. That’s whether they arise from exposed IT assets, unsecured endpoints and applications, cloud-based resources or other vectors. What makes exposure management and risk appetite so intertwined?

Assessing exposure according to acceptable risk levels: Exposure management involves quantifying the risk levels associated with different exposures. By defining acceptable risk, organisations can compare the possible impact of different risks with their risk appetite.
Deploying resources based on risk: Organisations must prioritise which exposures pose the greatest threat to their strategies – an assessment they can only make with a clear understanding of their risk appetite. That prioritisation lets them concentrate resources on mitigating the most critical ones, often with the help of an advanced RBVM tool.
Adjusting risk appetite: As a business environment changes or new risks emerge, risk appetite may need to be adjusted. The data and insights organisations uncover as part of their exposure management practice help them make informed decisions around such adjustments.
Ensuring compliance: Many industries have regulatory requirements related to risk management, which in turn influence an organisation’s risk appetite. Exposure management involves identifying and addressing risks that could cause non-compliance.

Related: Ivanti Research Report: Attack Surface Management

Looking at security risk through the lens of exposure management

A notable difference between exposure management and other security practices is that exposure management includes not just prioritising remediation of the risks that pose the most risk to the organisation, but actively defining which risks fall within an organisation’s risk tolerance. For example, an e-commerce company may be willing to accept heightened security risks in order to keep their site functional on Black Friday – the tradeoff is worth it to them.

Instead of viewing every potential risk as a crisis that needs instant remediation, organisations need to prioritise them based on business needs. In this framework, most risk isn’t bad: it’s about how you react to it, control it and mitigate it to bring it to an acceptable level.

The Five Ws (and H) of Exposure Management

Wed, 22 Jan 2025 17:10:20 Z

The Five Ws and H — who, what, when, where, why and how — have long been used as a checklist in journalism to make sure a story covers every piece of essential information. The same concept is employed here to make sure all the essential information about exposure management is covered in this post.

Read on for a better understanding of exposure management (the Five Ws) and actionable guidance for implementing it (the H).

Who

Who invented exposure management?

The term “exposure management” has been used in various contexts for decades, though it’s unknown when it was first used within the context of cybersecurity. That being said, exposure management is an evolution of vulnerability management, so it’s not an entirely new concept within the cybersecurity space but rather a reimagining of a preexisting practice.

Exposure management started gaining popularity in the cybersecurity space in 2022 as analyst firms began publishing research reports on the topic and vendors began releasing exposure management products and services.

Who benefits from exposure management?

Exposure management benefits a range of internal stakeholders — I recommend reading on if you fit any of the following profiles:

Role	Relevant Responsibility	Benefit
Security architect	Develop secure systems and networks	Improved understanding of risk posed to systems and networks
Vulnerability risk management (VRM)	Identify exposures and prioritise for remediation	Improved efficiency and accuracy of prioritisation process
SOC / security analyst	Detect and respond to cyber attacks	Lower volume of incidents requiring reactive response
IT operations	Remediate exposures prioritised by VRM	Lower volume of exposures requiring remediation
Development	Make code changes to resolve exposures in software	Lower volume of exposures requiring resolution
Chief information security officer (CISO)	Oversee infosec programme that protects systems and data	Stronger security posture better protects systems and data
Chief information officer (CIO)	Own management, implementation and usability of IT	Less downtime leads to improved digital employee experience
C-suite	Ensure day-to-day operations align with long-term strategies	Better equipped to make decisions regarding risk
Board of directors	Protect interests of shareholders and stakeholders	Fewer attacks means less damage to reputation and revenue
Business unit (BU) leader	Lead a specific division towards its goals	Decreased downtime of BU’s critical systems and services
Public relations (PR)	Reverse negative communication and perception around a crisis	Fewer PR crises stemming from cyber attacks
Chief financial officer (CFO) / finance organisation	Maintain the fiscal health of the organisation	Less unanticipated costs for cyber attack response and recovery
Compliance team	Ensure adherence to regulations and avoidance of missteps that could harm the organisation	Lower odds of violating regulations or experiencing other harm thanks to fewer breaches

External stakeholders also benefit when exposure management results in improved security postures for organisations. For example, customers are at lower risk of having their personally identifiable information (PII) compromised in a data breach and shareholders are less likely to see stock prices dip due to a brand’s reputation being damaged by a cyber attack.

Who “owns” exposure management?

This may seem illogical, or even controversial, but it’s the C-suite that owns exposure management. While Security owns day-to-day exposure management operations, those operations are executed at the direction of the executive team — as noted above, they’re the ones determining the organisation’s risk appetite. The numbers support this stance. 86% of security professionals we surveyed said that cybersecurity is a topic discussed at the board level.

Such a stance may have been blasphemous in the past, as most C-suite members lack the knowledge necessary to make cybersecurity decisions. But by focusing on exposure management, organisations can use quantifiable data to assess risks, reducing reliance on subjective judgement. This means that decisions regarding cybersecurity priorities and responses can be based on measurable risk factors, such as the likelihood of a threat and its potential impact.

Further, by linking cybersecurity operations directly to risk posture, exposure management offers a greater opportunity for aligning these operations with the overall business strategy. Under this approach, cybersecurity is no longer just a technical requirement but a strategic enabler that supports broader business objectives.

What

What is exposure management?

Exposure management is a proactive cybersecurity practice that enables organisations to maintain their exposures at a level that aligns with their risk appetite. It is, in essence, an evolution of vulnerability management that addresses the shortcomings of traditional vulnerability management practices.

Exposure management practices are commonly guided by continuous threat exposure management (CTEM) programmes.

Refer to Ivanti’s Exposure Management glossary page for a more thorough answer to this question.

What is continuous threat exposure management (CTEM)?

Continuous threat exposure management — or CTEM — is defined in the 2023 Gartner® Implement a Continuous Threat Exposure Management (CTEM) Program report as follows:

“Continuous Threat Exposure Management (CTEM) programme is a set of processes and capabilities that allow enterprises to continually and consistently evaluate the accessibility, exposure and exploitability of an enterprise’s digital and physical assets.

At any stage of maturity, a CTEM cycle must include five steps to be completed: scoping, discovery, prioritisation, validation and mobilisation.”¹

What are the components of exposure management?

In its current form, exposure management effectively combines capabilities from these existing categories:

Attack surface management (ASM), e.g., external attack surface management (EASM) and cyber asset attack surface management (CAASM).
Risk-based vulnerability management (RBVM).
Validation, e.g., breach and attack simulation (BAS), continuous automated red teaming (CART) and penetration testing as a service (PTaaS).

Expect to see purpose-built exposure management products and platforms as the exposure management market matures.

What is risk appetite?

Risk appetite is the level of cyber risk an organisation is prepared to accept in pursuit of its business objectives, such as increased agility, innovation or performance. To determine its risk appetite, an organisation must weigh the cost of maintaining a certain security posture against the benefit of doing so. Setting risk appetite is a business decision, though one that must include input from Security.

Refer to Understanding Risk Appetite – a Critical Component of Exposure Management for an in-depth description of risk appetite.

Where

Where should exposure management be implemented?

Exposure management practices should be implemented at all organisations that rely on technology that’s accessible from the internet or other external pathways.

Exposure management is especially important for organisations that are beholden to laws and/or other regulations regarding the safe handling of personal data. Examples include the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR).

Organisations likely to have lots of unknown devices connecting to the network and other unknown internet-facing assets in their environment are also optimal candidates for exposure management. Unknown assets often proliferate as a result of bring your own device (BYOD) policies and mergers and acquisitions.

When

When should I implement exposure management?

According to a Gartner press release, “By 2026, Gartner predicts that organisations prioritising their security investments based on a CTEM programme will realise a two-thirds reduction in breaches.”²We believe that’s a compelling reason to begin implementing exposure management as soon as possible. It’s also good news at a time when organizations’ attack surfaces are rapidly expanding, putting them at higher risk of attack.

More good news: any organisation practising vulnerability management has already laid the foundation upon which they can build an exposure management practice. Read on for actionable advice on how to do so.

Why

Why implement exposure management?

Many organisations have an incomplete understanding of their cyber risk due to limited views of the assets and exposures in their environments. Lots of effort is exerted in attempts to lower risk by remediating exposures, but the ROI on that effort is often low due to shortcomings associated with traditional vulnerability management methods.

Such organisations thus remain at elevated risk of experiencing cyber attacks that take advantage of un-remediated exposures and can negatively impact their operations, image and revenue. Exposure management solves this problem by empowering those organisations to maintain their exposures in alignment with their risk appetite.

The following is an overview of the shortcomings of traditional vulnerability management that exposure management addresses:

Shortcoming #1: Organisations look only at a narrow sliver of their continuously expanding attack surfaces.

Many organisations only closely monitor and manage their traditional perimeter — endpoints and servers — from a cybersecurity standpoint.

Why it’s a problem: Full attack surface visibility is needed to properly protect against all potential threats.

Modern attack surfaces have expanded beyond the traditional perimeter to include mobile devices, applications, websites, certificates/domains and more. Each of these components introduces added risk to an organisation that must be accounted for.

Shortcoming #2: The number of cybersecurity exposures organisations face continues to grow at an unmanageable rate.

There are hundreds of thousands of existing Common Vulnerabilities and Exposures (CVEs) and dozens — sometimes hundreds — more are published to the National Vulnerability Database (NVD) every day. And while CVEs are often the only type of exposure organisations account for, they face many others, such as misconfiguration of assets and security controls.

Why it’s a problem: Remediating all exposures is operationally infeasible, leaving organisations stuck in reactive mode.

Organisations are overwhelmed by the constant onslaught of exposures turning up in their environments. They can’t fix every exposure as that would require critical systems to be offline far too often — not to mention many exposures don’t have known fixes.

This forces them into firefighting mode, always trying to unbury themselves from endless exposures or overcome ongoing security incidents instead of working proactively to improve their security posture.

Shortcoming #3: Remediation activities are prioritised based strictly on the severity of vulnerabilities.

The Common Vulnerability Scoring System (CVSS) v3.1 is among the most popular methods for prioritising vulnerabilities for remediation. CVSS assigns vulnerabilities with scores from zero to 10 based on their severity — zero being the least critical and 10 being the most.

Unfortunately, those scores don't account for real-world threat context — meaning organisations employing CVSS are misguided if their intent in doing so is to reduce risk.

Why it’s a problem: Remediation decisions are based on the makeup of vulnerabilities instead of a given organisation’s risk appetite and the potential impact a given vulnerability may pose to their business.

Organisations that use CVSS are basing decisions on vulnerabilities’ characteristics without accounting for their own. For starters, since CVSS scores don’t accurately reflect risk, organisations can’t use CVSS to determine if a given vulnerability exceeds their individual risk appetite.

Further, CVSS doesn’t enable organisations to determine how a vulnerability might impact their business — certainly a crucial consideration when determining whether that vulnerability needs to be remediated.

How

How do I implement exposure management?

This bears repeating one more time: exposure management is an evolution of vulnerability management. Most organisations thus already have the foundation for its exposure management practice in place.

But how do you advance from vulnerability management to exposure management? Here are six best practices to guide the process:

Best practice #1: Widen your attack surface aperture

Evolving to exposure management requires widening your attack surface aperture to include non-patchable attack surfaces. While you’ll always need to account for traditional devices and applications, nowadays, you also need to account for all systems, applications and subscriptions, including those not owned by IT or even managed by the business.

Examples include everything from third-party applications and services — such as SaaS, supply chain dependencies and online code repositories — to corporate social media accounts and leaked data. To gain this visibility, you’ll need to implement digital risk protection services (DRPS) and external attack surface management (EASM) solutions in addition to any existing cybersecurity asset management (CSAM) tools.

Best practice #2: Reframe remediation

If you expand your exposure management programme to include non-patchable attack surfaces, you’ll also need to expand it to include means for managing your exposure through ways other than patching.

There are many routes to resolution for threat exposures, ranging from accepting and managing the risk by increasing monitoring, through to mitigation and resolutions that, in addition to patching, may mean implementing a policy change or redeveloping an application.

Remember, there's often more than one fix to an issue, and your team will often need to collaborate closely with other teams to implement those fixes, including infrastructure and operations teams and enterprise architecture functions. In some cases, your team may need to acquire new skills and understanding to execute fixes that fall under Security’s umbrella.

Best practice #3: Reprioritize

As mentioned under “Why implement exposure management?” above, using CVSS to prioritise exposures for remediation omits risk from the prioritisation process. That can be remedied through the use of risk-based vulnerability management (RBVM) solutions.

Here’s how such solutions improve exposure management, using the graphic above as a reference:

There are 330,000+ known vulnerabilities.
Fortunately, you don’t need to remediate every vulnerability in your environment. The number that are tied to ransomware is low, and even less are trending/active exploits.
RBVM solutions provide risk-based scoring and views to help you focus remediation efforts on that small number of vulnerabilities that pose a significant risk.

Ultimately, a risk-based approach ensures you don’t waste time and effort mitigating or remediating any of the hundreds of thousands of exposures that pose no real danger to your organisation, and that the effort you do expend actually goes toward improving your security posture.

Best practice #4: Build a bridge to the business side

With traditional vulnerability management, the “business side” typically only learns a patch is coming when they receive a notification telling them their PC needs to restart to finish installing updates — such is not the case with exposure management.

For starters, their input is required to determine the business impact of exposures and your organisation’s risk appetite. You’ll need to continually work with the revenue-generating functions of the organisation to determine what systems and solutions have a high impact on their priorities so that exposures that threaten those systems and solutions can be prioritised accordingly.

This is the type of work that earns Security a seat at the business table — work that shows Security exists to enable the business. Of course, teams on the business side may not be thrilled with the prospect of taking on extra work for something that has never been their responsibility, but there are ways to earn their buy-in:

CISOs need to lead the outreach effort — their position within the organisation will make it easier for them to open the necessary doors.
Once you’re in the door, work with senior leadership to develop metrics that will enable them to make effective exposure management decisions without having to be security specialists.
Ensure you keep all the departments you interact with informed on the various options that exist for resolving issues that may impact them. You may need to put in extra time here to shed Security’s reputation for being overly restrictive.
Make it clear to them that the business will simply have to accept large amounts of unknown and unquantified risk if a poorly governed exposure management programme fails to accurately scope, discover, prioritise and validate issues, thereby leading to a lack of visibility into threat exposure.

Best practice #5: Validate, validate, validate

Traditional vulnerability management is guided by prioritisation, while exposure management couples prioritisation with validation. Validation is necessary since prioritisation alone leaves a large volume of issues to resolve.

In the context of exposure management, validation involves:

Assessing how potential attackers can exploit an identified exposure.
Estimating the highest potential impact of potential attack paths.
Identifying how monitoring and control systems might react in the event of an attack.

Validation can be conducted via a mixture of manual and technological methods, including:

Penetration testing conducted by automated tools, internal teams or contract pen testing as a service (PTaaS).
Red team exercises.
Breach and attack simulation (BAS).
Attack path analysis.

Best practice #6: Crawl, walk, run

Last but not least, the final best practice for evolving to exposure management is: don’t attempt to do it overnight. Use your vulnerability management practice as your starting point and expand from there by adopting the other best practices covered here as your bandwidth and budget allow.

Gartner. D’Hoinne, J., Schneider, M., Shoard, P. (2022, July 21). Implement a Continuous Threat Exposure Management (CTEM) Programme. https://www.gartner.com/document/4016760.
Gartner Press Release. Gartner Identifies the Top Cybersecurity Trends for 2024. (2024, February 22). https://www.gartner.com/en/newsroom/press-releases/2024-02-22-gartner-identifies-top-cybersecurity-trends-for-2024.