risk management
“No risk, no reward,” may be true, but unnecessary risk is . . . well, unnecessary. Read our insights on risk management and mitigation.
Insights
Blog
Announcing Forrester’s 2026 Security & Risk Enterprise Leadership Award Winner: CITGO
CITGO is the winner of Forrester’s 2026 Security & Risk Enterprise Leadership Award. See how the company embeds security, risk management, and trust into business decisions, operations, and emerging technology planning.
Blog
GRC Customers Have Spoken: Four Market Realities Vendors Can’t Ignore
This week, I published the Buyer’s Guide: Governance, Risk, And Compliance Platforms, 2026, summarizing how satisfied clients are with their governance, risk, and compliance (GRC) platforms. The report is based on customer reference data from The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q2 2026. Speaking to customers during evaluative research processes is my favorite […]
Blog
Manage Insider Risk To Protect Your Potential
National Insider Threat Awareness Month is drawing to a close. This year’s theme, “Protect Our Potential,” speaks directly to the impact that insider incidents can have. According to Forrester data, insider incidents account for 25% of data breaches, and a third of those incidents are due to malicious intent. Yet many organizations still don’t have […]
Blog
Who Will Become The Trusted Assurer Of Your Enterprise AI?
California’s recently enacted AI legislation may ultimately matter for a reason that has received relatively little attention. Senate Bill 813 and Assembly Bill 1405 are not just about governing AI systems. They begin to formalize expectations for the organizations that assess, verify, and audit those systems. The state’s subsequent executive order reinforces that direction by […]
Frequently Asked Questions
What is risk management?
Risk management is the ongoing practice of identifying, assessing, and responding to uncertainty that could affect an organization’s objectives or value. It spans strategic, operational, financial, technology, and security risks and helps leaders balance potential reward with acceptable levels of exposure.
How does risk management relate to security and risk?
Risk management provides the context for security decisions by treating threats as business risks, not just technical issues. It helps organizations prioritize security investments, integrate controls into governance, and ensure that protection efforts align with enterprise goals and risk tolerance.
What types of risk information should leaders monitor?
Leaders should monitor both quantitative metrics, such as likelihood, impact, and exposure, and qualitative signals like regulatory change, market shifts, and stakeholder sentiment. Tracking trends and emerging risks enables earlier action and better-informed strategic decisions.
What challenges do organizations face in implementing risk management?
Organizations often struggle with fragmented ownership, inconsistent data, and limited visibility across risk types. Siloed teams and immature governance can slow response and undermine confidence. Effective risk management requires coordination, clear accountability, and continuous adaptation as conditions change.
How does Forrester support clients in risk management?
Forrester helps leaders translate risk insight into better decisions. Through research, models, and advisory support, we guide organizations in maturing risk practices, aligning risk with strategy, benchmarking capabilities, and using risk management to enable growth rather than simply limit exposure.
Blog
Your Digital Workplace Is Only As Modern As Your Worst App
Most enterprises have at least one application that refuses to retire. It solves an indispensable business problem, depends on obscure integrations, and runs on code that few people fully understand. Its interface may be decades old, but the business still cannot function without it. These applications persist for legitimate reasons. Replacing them can be costly, […]
Blog
Announcing The Inaugural Risk Consulting Services Landscape, Q3 2026
This week, I published The Risk Consulting Services Landscape, Q3 2026 (Forrester clients only). This is our first review of the landscape for risk consulting firms advising risk, compliance, and internal audit leaders. Until the introduction of AI in late 2022, services offered by risk consulting firms had changed little since I hung up my consultant […]
Blog
Rules Of The Road: What Flock’s 71% Misread Rate Teaches Us About Third-Party AI Risk
Roseville, California just provided a case study in what happens when organizations confuse “AI-powered” with “AI-verified.” A Business Insider investigation found that Flock Safety’s AI license plate readers misread plates in 71% of the alerts sent to Roseville police over two years, incorrectly flagging vehicles as stolen or linked to a felony. That number isn’t […]
Blog
Why Your AI Strategy Needs A DEXM Solution: Lessons From Nexthink’s Masters Of Experience
Last week at Nexthink’s Masters of Experience event in London, one theme came through clearly in every conversation I had with digital workplace leaders, IT practitioners, and experience innovators: The ways that organizations use digital employee experience management (DEXM) solutions are expanding. AI dominated the agenda — as expected. But the real story wasn’t about […]
Blog
The CLM Market Has A Messaging Problem, Not A Capability Problem
If you’ve ever tried to meet someone “at Ray’s Pizzeria” in Manhattan, you already understand the contract lifecycle management (CLM) market. “Original Ray’s.” “Famous Ray’s.” “World Famous Original Ray’s.” Same name, similar awning, very different experience. That’s CLM right now: Vendors sound alike, but they’re not built alike. Diverse Functionality, Copy-Paste Claims Every vendor is […]
Blog
Announcing The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q2 2026
Check out the latest Forrester Wave™ evaluation of the governance, risk, and compliance platforms market and its findings.
Blog
Drowning In Rules: Navigating America’s AI Regulatory Patchwork
US companies are drowning in AI rules. With a labyrinth of conflicting state laws and no single federal requirement, even the most responsible innovators are struggling to stay afloat. California’s landmark Transparency in Frontier Artificial Intelligence Act proved that states can regulate AI without killing innovation, but it also underscores a hard truth: The current […]
Blog
Not A Vendor, Still A Breach: Vercel’s Third-Party Risk Failure
Some security incidents are complex. The Vercel incident is more troubling because it was predictable. The attackers did not exploit a procurement gap. They exploited a definition gap. Here’s what happened. A Vercel employee signed up for Context.ai’s AI Office Suite using a corporate Google account and clicked something effectively equivalent to “Allow All,” granting […]
Blog
Today’s Regulatory Intelligence Solutions Replace Drudgery With Confidence
Over the past five years, security and risk (S&R) professionals have experienced a flood of new cybersecurity regulations, with 170 countries now boasting cybersecurity and data protection laws. Leaders are left to decide which regulations apply, identify gaps, and implement controls — an onerous task as regulatory volume and the pace of change accelerate. Manual […]
Blog
Volatility Isn’t Temporary — Account For It In Your Leadership Playbook Going Forward
For many B2B leaders, volatility no longer feels like an interruption to “normal.” It is now the standard operating environment. Economic uncertainty, geopolitical shocks, AI-driven disruption, and shifting buyer behavior are colliding, exposing weaknesses in traditional go-to-market models and leadership assumptions. The good news? Volatility can benefit those who adapt faster, focus harder, and lead […]
Blog
Cyber Risk Ratings Fade Out; Actionable Intelligence Takes The Spotlight
In musical notation, “al niente” means fading until sound is barely perceptible, usually to end a significant piece of music such as the ending of Tchaikovsky’s reflective and somber sixth symphony. And that is how the cybersecurity risk ratings market is likely to proceed over the coming months. Ratings will not fade away to nothing […]
Blog
The Expanding Universe Of GRC For AI: Key Questions From Technology Leaders
In 1929, astronomer Edwin Hubble discovered something unsettling. The universe isn’t static; it’s expanding everywhere, simultaneously, at every scale. His simple equation (Hubble’s law) shows that galaxies are accelerating away from each other, and the farther they are, the faster they recede. Eventually, galaxies become so distant that they cross our observable horizon entirely — […]
Blog
The Mandela Effect In TPRM: Why Companies Still Misremember Their Third-Party Risk Exposure
What do the Monopoly man’s monocle, the Fruit of the Loom cornucopia, and “Luke, I am your father” have in common? None of them actually exist the way you remember. That glitch is the Mandela effect, a collective misremembering of facts or events, and it is the same mental bug that convinces executives that their […]
Blog
2026 Really Is This Risky: Our Top Recommendations For CISOs
Security leaders entered 2026 with little expectation that uncertainty will ease … ever. Economic pressure, geopolitical instability, accelerating artificial intelligence adoption, and renewed technology consolidation have turned volatility into a structural condition rather than a temporary disruption. This is life now, and CISOs are being asked to move faster, support aggressive AI initiatives, and protect […]
Blog
Ready For OpenClaw To Pry Into Your Environment And Grip Your Data
A formidable challenge awaits security leaders as personal tools like Moltbot spread. AI butlers are the next shadow super-user.
Blog
Beyond The Robots: What CES 2026 Really Means For Digital Workplace Leaders
I kicked off 2026 by attending CES for the first time, and I can confirm that everything you’ve heard about this event is true. CES is massive. It’s sprawling. The scale was equal parts energizing and overwhelming — but once I got past the sensory overload, clear and meaningful signals started to emerge. Beneath the […]
More posts