Cyber Resilience Awareness Day Virtual Summit 2026

Sign up for this talk here, or for ALL sessions of the ISSA International Cyber Resilience Awareness Day Virtual Summit here: https://issa.brighttalk.com/summit/8195/

Most organizations assess cyber resilience by confirming and documenting what controls exist and how mature the processes around them are. Maturity frameworks, compliance audits, and risk registers all answer the same question: what did we design? None answer the question that matters when a threat arrives: is it working right now?

Controls degrade between assessments. Patches slip. People make rational trade-offs under pressure. The result is control drift, a growing gap between the resilience posture an organization believes it has and the one that actually exists, oftentimes a gap that is invisible to point-in-time assessments and maturity scores.

This talk examines why the gap exists, why conventional measurement misses it, and what to do instead: decomposing controls into measurable mechanisms — detection reliability, response timeliness, resistance strength — and replacing assumptions with rolling measurement from telemetry you already have. It shows how the same control configuration produces dramatically different risk outcomes in different operational contexts, how continuous control measurement can feed quantified risk analysis when decisions demand it, and why resilience is something you measure continuously and not something you declare by checkbox.

Featuring:
Laura Voicu, Co-Founder & CDSO, Enterprise Risk Quantification Institute (ERQI)