How to Choose the Right GRC Tool: Fit, Outcomes and Implementation Matter
Choosing the right GRC tool starts with understanding the program you need to operate. Cheri Hotman and Angie Iturbide explain how to evaluate GRC platforms based on fit, outcomes, implementation, adoption, reporting, risk, controls, automation, and total cost of ownership.
2025 Verizon DBIR: Key Security Awareness Takeaways for Organizations
The 2025 Verizon DBIR highlights major cybersecurity risks involving people, ransomware, vulnerabilities, third parties, stolen credentials, unmanaged devices, and AI. Tanya Wade breaks down the key findings and practical steps organizations can take to reduce risk.
Cybersecurity Tools Aren’t Enough: Why Strategy, People and Process Matter
Cybersecurity tools alone do not create a mature security program. Cheri Hotman and Zoltan explain why strategy, people, process, ownership, monitoring, third-party risk, and continuous improvement are essential to getting real value from cybersecurity technology.
How to Choose the Right Cybersecurity Framework: A Practical Guide for Leaders
Choosing the right cybersecurity framework starts with understanding business goals, customer demands, risk, maturity, and current-state controls. Cheri Hotman and Tanya Wade explain how leaders can select, map, implement, monitor, and mature cybersecurity frameworks without falling into checkbox compliance.
AI Security Awareness: Emerging Risks and How to Use AI Safely at Work
AI can improve productivity, but it also creates new risks involving sensitive data, inaccurate outputs, shadow AI, phishing, deepfakes, malicious tools, and overreliance. This Hotman Group security awareness resource explains how employees can use AI more safely at work.
The Audit Trap: Why Passing isn’t Protection
Passing a cybersecurity audit does not automatically mean an organization is secure. Cheri Hotman and Troy Fine explain how checkbox compliance, weak audit practices, false confidence, poor resourcing, and overreliance on automation can undermine real risk management.
Social Engineering Awareness: How to Recognize Phishing, Smishing and Vishing
Social engineering attacks use trust, fear, urgency, and impersonation to manipulate people into clicking links, sharing information, or providing access. Learn how to recognize phishing, smishing, vishing, and other common social engineering tactics.
CMMC Compliance: Cutting Through the Confusion for Defense Contractors
CMMC compliance requires more than policies, tools, and checklists. Cheri Hotman and Paula explain how defense contractors should approach CMMC scoping, CUI, NIST 800-171, readiness, evidence, documentation, remediation, assessment preparation, and ongoing program management.
Building Customer Trust in the Digital Age: Why Security and Compliance Drive Revenue
Customer trust is no longer built only through brand reputation, relationships, or a good product. Increasingly, customers want evidence that the organizations they work with can protect data, manage cybersecurity risk, meet compliance obligations, respond to incidents, support accessibility, govern emerging technologies, and operate responsibly. In this Hotman Group session, Cheri Hotman and Sarah discuss […]
