2025-10-29 –, Jade Software Corporation
In security, poor risk assessment leads to wasted resources or catastrophic breaches. Traditional frameworks like NIST RMF and FAIR help—but often fail to address human biases, vague "High/Medium/Low" ratings, and misaligned priorities. This 3.5-hour workshop equips security specialists with calibrated estimation techniques to quantify risks more accurately. Through hands-on exercises, case studies, and probabilistic thinking, you’ll learn to move beyond guesswork, communicate risks effectively, and make data-driven security decisions. Leave with practical tools to answer critical questions: How likely is this threat? What’s the real impact? Where should we invest first?
Key Takeaways:
✔️ Fix overconfidence and cognitive biases in risk assessment
✔️ Apply calibration methods for sharper estimates
✔️ Justify security decisions with clearer, evidence-based reasoning
Introduction
- Why risk assessment is the backbone of security strategy
- Common pitfalls: Overconfidence, vague estimates, and misaligned priorities
- The cost of poor risk estimation: Wasted resources vs. catastrophic breachesThe State of Risk Assessment
- Overview of existing approaches (ISO 27005, NIST RMF, FAIR, OCTAVE)
- Key challenges:
- Qualitative vs. quantitative—when each fails
- "High/Medium/Low" risks—why they’re often meaningless
- Cognitive biases in risk estimation (anchoring, over-optimism, groupthink)A Better Way: Calibrated Risk Estimation
- Introducing probabilistic thinking in security
- The concept of calibration: Why some people are better estimators
- Hands-on calibration exercises:
- Estimating likelihoods of security events (breaches, insider threats)
- Learning to express uncertainty with confidence intervalsApplying Calibration to Real Security Decisions
- Case studies:
- Prioritizing patches vs. investing in detection
- Evaluating ROI on security controls
- Group exercise: Assessing a fictional company’s risks with calibrated estimatesMaking Better Security Decisions
- How to communicate risks effectively to stakeholders
- Moving from "gut feeling" to evidence-based decisions
- Tools & techniques to improve risk assessment over timeQ&A + Wrap-Up
- Key takeaways
- Further learning resources
Workshop Takeaways:
✅ Better Estimation Skills – Avoid common biases and quantify risks more accurately.
✅ Data-Driven Decisions – Justify security investments with clearer reasoning.
✅ Stronger Communication – Explain risks in a way executives and teams understand.
Why Attend?
Most risk frameworks fall short because they don’t address human judgment errors. This workshop gives you practical tools to assess risks more objectively and make smarter security choices.
Anna Lezhikova is a cyber security consultant based in Wellington, New Zealand. She combines her experience in sociology, business management, communications, and IT to help companies to run and grow their business securely in the digital age. Armed with a Master's degree in Sociology, an MBA, and a Diploma in Machine Learning and Artificial Intelligence, Anna's expertise is fortified by practical know-how as a full-stack and DevSecOps engineer. This unique blend equips her with the capability to see problems from different perspectives and come up with holistic solutions.