Inherent risk & business strategy with Patrick Hayes

Rachelle Loyear, Vice President of Integrated Security Solutions, is the coauthor of the original Enterprise Security Risk Management texts, Tim McCreight, Founder of TaleCraft Security and ASIS International past president,  has 4 decades of security experience and was one of first field practitioners putting ESRM into practice in multiple organizations. Both have released new books in the last few months,  Loyear's book makes ESRM more accessable than ever, McCreight's book captures the lessons learned over a lifetime of influence, pulls no punches while respecting the human factor so often over looked in modern management texts.  This is a chance to dive deep into the backstory for both and the perspective that only two of the ESRM OG cohort can bring.

Security systems protect the resources and mission of an organization, unlike most episodes where the impact is in dollars, this time it's the people behind the decisions.  Crisis management doesn't start when the fire alarm rings and an afternoon team building activity wont repair the dynamics that could be the biggest threat to an organization's resilience. Carlamay Sheremata tackles the issues head on, drawing on her years of frontline police work and recovery from the toll a service career takes on the psyche.  Drawing from the experiences and lessons published in her International Impact award winning book "Youth Truth",  Ms. Sheremata also shares how the CALM approach can cross all age ranges.   

Doug and Tim wrap up the summer with a look at both regulatory changes for critical infrastructure post Bill C8 and then jump across the ocean to dig into some European regulations. AI is top of mind for most and while the technology may be fascinating for some,  the business consequences of bad decisions don't magically disappear. Critical thinking is potentially the best risk mitigation option there is in this turbulent time and the podcast hosts recommend one more book for the reading list, Winn Schwartau's MetaWar. 

There are few business strategy conversations in 2026 that don't include the term AI, yet like the digital "game changers" before such as mobility, voice over IP, Cloud computing and of course the internet,  after the hype fundamentals still matter in business. Patrick Hayes , a cyber security thought leader long before it was fashionable, recently released the second book in a series exploring assurance within digital business systems and services.  Most organizations are now in a continuous state of digital transformation in one form or another, AI has increased the speed, scope and potential impacts almost overnight minus guard rails.  Integrated Assurance  introduced the framework,  Relevant Impact is a field guide for both delivering an protecting value in this highly volatile time. While frameworks and strategic thinking tend to morph slowly, AI and it's impact on the digital aspects of all organizations is extremely fluid. Follow Patrick's current research in this space via his regular publications.

Our inaugural podcast guest and friend of the show Rachelle Loyear has recently released her third book, "Enterprise Security Risk Management (ESRM) in the Real World".  We are adding to the Caffeinated Risk summer reading list and marking the occasion with some additional content from the May 2023 episode . Despite being more than two years prior to the recent OpenAI Hugging Face incident,  Rachelle's frank discussion about both the potential and the risks associated with AI agency are a cautionary tale for all risk professionals implementing or assessing AI security solutions.

Richard LaTulip joins Caffeinated Risk for a candid conversation connecting cybercrime investigations, threat intelligence, and practical business risk. Richard is a Field CISO with Recorded Future, a former United States Secret Service special agent, and both the author and real-life main character behind the true crime story Operation Carder Kaos.The discussion starts with Richard’s experience investigating organized cybercrime and quickly moves beyond the “kid in a hoodie” myth toward the reality of structured criminal ecosystems, specialized roles, and professionalized operations. From there, the conversation turns to what threat intelligence should actually do for security teams: be timely, relevant, and actionable.Tim, Doug, and Richard explore how organizations can use actionable intelligence to assess vulnerabilities based on actual business impact, not just severity scores or compliance checkboxes. That risk-based approach is a core ESRM touchstone and is becoming even more important as AI-assisted cyber attacks increase the speed, scale, and adaptability of adversaries.

Visiting the Jacobs Engineering website you'll undoubtedly encounter the phrase "challenging today",  an acknowledgement that the world is much more complex than ever before.  While "it ain't like it used to be" can be said of any risk manager's portfolio,  Joe Olivarez became the first global security leader in Jacobs history more than a dozen years ago. How much has changed in the last 3 years, let alone 13.  Currently the Vice President, Operational Center of Excellence for Jacobs, Joe shares a candid discussion on how risk management has changed both wholistically as a profession and more specifically with large infrastructure projects.  In addition to executive leadership for a world renowned organization, Mr. Olivarez is the most recent past president of ASIS , joining the show's own ASIS past president discussing ESRM roots.

Joshua Copeland's cyber security moniker is "The Unpopular Opinion Guy",  while most of us in security roles have been that person with an unpopular opinion at least a time or two, Copeland turned it into both a book and a bit of a movement through numerous posts on Linkedin about many of the challenges in our industry.That said, this is not a mud slinging episode,  Joshua had numerous, pragmatic examples of both the problem space and ways to address them. There are a lot of misconceptions about cyber security but there are also a wide array of real world impacts in our daily lives making this a very difficult area to master.  Mr. Copeland has some of the unlock codes, making for another compelling episode. 

"Legal and Regulatory" is a common receptor category  in most enterprise risk matrices but with any luck most organizations have limited direct experience with cyber litigation matters.  This episode jumps right into the deep end with one of Canada's preeminent cyber lawyers,  Brent Arnold.  Business law has evolved over hundreds of years, cybersecurity precedents began to appear on the legal landscape in the late 1980s and AI is the new kid on the block, barely out of diapers. While this episode can not be considered legal advice the chance to listen in on the ideas and opinions of from someone on the frontlines of this emerging risk vector should not be missed.

Cyber crime is now a daily fact of life and a significant concern in both the private and public sectors but our response capabilities do not seem to be keeping up.  This episode dives deep into one organization that is combatting this problem with a combination of academic research, industry expertise and hands-on training with the founder and CEO, Herbert Fensury. While cyber security is a global problem, economics and politics dictate different solution requirements. The Canadian Cyber Assessment, Training and Experimentation (CATE) Centre is both cutting edge and focused on Canadian cyber resilience at both a regional and national level.