Supply Chain Security: How to Build a Risk-Based Third-Party Risk Management Program
Every vendor relationship introduces risk. In this Hotman Group session, Cheri Hotman explains how organizations can move beyond questionnaires and annual compliance exercises to build a sustainable, risk-based approach to supply chain security and third-party risk management. Watch the Session Cheri walks through third-party risk, fourth-party dependencies, vendor tiering, inherent and residual risk, questionnaires, shared […]
Compliance vs. Security: How to Make Both Work Together to Reduce Risk
Compliance and cybersecurity are often treated like competing priorities: one focused on audits and the other focused on “real” security. In this Hotman Group session, Cheri Hotman explains why that framing is wrong — and how organizations can use compliance, cybersecurity, governance, people, process, and technology together to reduce risk and build a stronger security […]
Multi-Framework Compliance: How to Build One GRC Program for Many Frameworks
Managing multiple compliance frameworks does not require separate programs for each one. Cheri Hotman and Ravi Kant explain how organizations can rationalize overlapping requirements, build a common control environment, reuse evidence, support business growth, and operate one scalable Cyber GRC program.
Ransomware Awareness and Prevention: What Employees and Organizations Need to Know
Ransomware can disrupt operations, expose sensitive data, and lock critical systems. Learn how ransomware spreads, how employees can recognize warning signs, practical prevention measures, and what to do if an attack is suspected.
How to Choose the Right GRC Tool: Fit, Outcomes and Implementation Matter
Choosing the right GRC tool starts with understanding the program you need to operate. Cheri Hotman and Angie Iturbide explain how to evaluate GRC platforms based on fit, outcomes, implementation, adoption, reporting, risk, controls, automation, and total cost of ownership.
2025 Verizon DBIR: Key Security Awareness Takeaways for Organizations
The 2025 Verizon DBIR highlights major cybersecurity risks involving people, ransomware, vulnerabilities, third parties, stolen credentials, unmanaged devices, and AI. Tanya Wade breaks down the key findings and practical steps organizations can take to reduce risk.
Cybersecurity Tools Aren’t Enough: Why Strategy, People and Process Matter
Cybersecurity tools alone do not create a mature security program. Cheri Hotman and Zoltan explain why strategy, people, process, ownership, monitoring, third-party risk, and continuous improvement are essential to getting real value from cybersecurity technology.
Security Awareness Training – Artificial Intelligence & Emerging Security Risks
Join us for an essential Security Awareness Training session focused on the evolving landscape of Artificial Intelligence (AI) and the emerging security risks that come with it. In this session, we explore how AI is being used in everyday tools—and how it’s also creating new opportunities for threat actors. This training emphasizes awareness, responsible usage, […]
The Audit Trap: Why Passing isn’t Protection
Think passing an audit means your cybersecurity program is solid? Think again. Many organizations unknowingly expose themselves to greater risk by relying on compliance checkmarks rather than a true security strategy. In this session, we’ll uncover the hidden dangers of audit-driven security, why “passing” may leave you more vulnerable, and the real steps leaders must […]
