Cybersecurity Is as Much Art as Science: Why Risk and Business Context Matter
Cybersecurity is technical, but technology alone does not determine whether a security program works. In the welcome episode of the Hotman Group podcast, Cheri Hotman explains why effective cybersecurity requires judgment, risk management, business alignment, people, process, technology, and the ability to make practical decisions within real-world constraints. Listen to the Episode In this introductory […]
Supply Chain Security: How to Build a Risk-Based Third-Party Risk Management Program
Every vendor relationship introduces risk. In this Hotman Group session, Cheri Hotman explains how organizations can move beyond questionnaires and annual compliance exercises to build a sustainable, risk-based approach to supply chain security and third-party risk management. Watch the Session Cheri walks through third-party risk, fourth-party dependencies, vendor tiering, inherent and residual risk, questionnaires, shared […]
Compliance vs. Security: How to Make Both Work Together to Reduce Risk
Compliance and cybersecurity are often treated like competing priorities: one focused on audits and the other focused on “real” security. In this Hotman Group session, Cheri Hotman explains why that framing is wrong — and how organizations can use compliance, cybersecurity, governance, people, process, and technology together to reduce risk and build a stronger security […]
Multi-Framework Compliance: How to Build One GRC Program for Many Frameworks
Managing multiple compliance frameworks does not require separate programs for each one. Cheri Hotman and Ravi Kant explain how organizations can rationalize overlapping requirements, build a common control environment, reuse evidence, support business growth, and operate one scalable Cyber GRC program.
Ransomware Awareness and Prevention: What Employees and Organizations Need to Know
Ransomware can disrupt operations, expose sensitive data, and lock critical systems. Learn how ransomware spreads, how employees can recognize warning signs, practical prevention measures, and what to do if an attack is suspected.
How to Choose the Right GRC Tool: Fit, Outcomes and Implementation Matter
Choosing the right GRC tool starts with understanding the program you need to operate. Cheri Hotman and Angie Iturbide explain how to evaluate GRC platforms based on fit, outcomes, implementation, adoption, reporting, risk, controls, automation, and total cost of ownership.
2025 Verizon DBIR: Key Security Awareness Takeaways for Organizations
The 2025 Verizon DBIR highlights major cybersecurity risks involving people, ransomware, vulnerabilities, third parties, stolen credentials, unmanaged devices, and AI. Tanya Wade breaks down the key findings and practical steps organizations can take to reduce risk.
Cybersecurity Tools Aren’t Enough: Why Strategy, People and Process Matter
Cybersecurity tools alone do not create a mature security program. Cheri Hotman and Zoltan explain why strategy, people, process, ownership, monitoring, third-party risk, and continuous improvement are essential to getting real value from cybersecurity technology.
How to Choose the Right Cybersecurity Framework: A Practical Guide for Leaders
Choosing the right cybersecurity framework starts with understanding business goals, customer demands, risk, maturity, and current-state controls. Cheri Hotman and Tanya Wade explain how leaders can select, map, implement, monitor, and mature cybersecurity frameworks without falling into checkbox compliance.
