GRC & Me

What does it take to build a GRC program that executives and boards actually trust? For Nidhi Luthra, the answer came from more than a decade of doing it the hard way: as CISO across some of healthcare's largest and most complex health systems, and ultimately as Global CISO at Baxter International, where she also became a LogicGate customer. In this episode of GRC & Me, Nidhi shares the career moments that shaped her philosophy on GRC, how her thinking evolved from compliance-first to risk-and-resilience-first, and what she'd tell her earlier self about building programs that hold up under pressure. If you're on the CISO path, or building the GRC function that supports one, this conversation is for you.

In the season 8 finale, guest host Jade Trombetta is joined by Salim Alameddin, Senior Vice President at Crossroads Strategies, LLC to discuss key cybersecurity and AI regulation trends and new administration objectives that will shape 2025. They explore a variety of topics from the evolving landscape of cybersecurity, including the growing threat of geopolitical cyberattacks, to AI and compliance under the new administration. They also chat about the challenges some of the cabinet may have jumping from the tech world into government work, and other 2025 economic trends our GRC community is interested in. Tune in for a conversation on the critical issues faced today.

Join us in this episode as host Meghan Maneval and Michael Rasmussen - GRC Analyst & Pundit at GRC 20/20 Research, LLC - discuss vendor risk management and the differences between third, fourth, and fifth-party risks. They discuss essential regulations and standards in the financial and banking sectors, highlighting how they vary by organization maturity. As well as best practices for effectively building and managing a comprehensive vendor risk management program and staying current with risk management standards. Michael touches on the role of automation and AI in enhancing vendor risk programs, as well as their limitations. And he shares his 2025 regulatory predictions and their potential impact on vendor risk strategies in the financial services.

Optimizing Risk: GRC is no longer a cost center - it’s a business enablerGuests: LogicGate CEO, Matt Kunkel and CISO, Nick KathmannHistorically GRC was viewed as one line in a budget sheet, but that is rapidly changing. GRC practitioners are elevating their programs with tools and technologies that aggregate data and story-tell situational risk, security, compliance changes and more so businesses can make risk-based decisions to move the needle forward. Matt Kunkel and Nick Kathmann will share why good security pays for itself, the role GRC plays in the boardroom and how to connect GRC programs to business impact. 

They say it takes a thief to catch a thief, so why not a hacker to catch a hacker? That was the premise behind Ted Harrington’s Independent Security Evaluators, a company dedicated to poking holes into other companies’ cyber defenses — for the right reasons, of course. On this episode of GRC & Me, Ted takes LogicGate’s Chris Clarke on a journey down the benevolent hacker’s rabbit hole, where they discuss:The difference between white box and black box testing (and which is better.)Why carrying these exercises out can build trust and become a competitive advantage in third-party risk assessment.Why it’s important to shift your mindset from one that views security as an obstacle to one that views it as an opportunity.Uncovering the unknown unknowns in cybersecurity.How “defense in depth” strategies can put security teams a step ahead of threat actors.The four traits that lead hackers to be successful, and why thinking like one can be an effective way to bolster your cyber defenses.

One of the most high-profile risk events of the last year was the swift collapse of Silicon Valley Bank and other regional banks amid spiking interest rates. Part of the problem? The lack of a complete, comprehensive view of the risks these banks were facing — in particular, liquidity risk.Allstate Canada's Chief Risk Officer Jason Wang has spent his career assessing and analyzing risk in the financial services space, dedicated to anticipating and mitigating risks just like the one that sank SVB. On this episode of GRC & Me, Jason joins LogicGate’s Chris Clarke to discuss the importance of building a holistic risk register, how to position risk management as a strategic enabler instead of a “revenue prevention” department, why it’s critical to include your chief risk officer on the executive team, and more.

Oftentimes, cyber risk teams are viewed as reactive “audit police,” swooping into projects to flag risks and forcing changes at key points. This approach can generate a resentful — even toxic — risk culture. There’s a better way to build healthier risk cultures: Taking a more collaborative, embedded approach to cyber risk management by positioning cyber risk leaders as advisors and partners, working side-by-side with project teams from the start.On this episode of GRC & Me, Chris Clarke is joined by Cyberpink’s Founder & Owner, Praj Prayag-Deb, to discuss how to shift your organization’s risk culture toward this new approach, her formula for building successful cyber risk programs from scratch, how leveraging the right technology makes it all possible, and why adopting a growth mindset is critical for every cyber risk leader.

With information and cybersecurity incidents growing in frequency and severity, regulators in the European Union are hard at work devising new rules designed to incentivize organizations to harden their cyber defenses.On this episode of GRC & Me, Megan Brown sits down with Wizz Air’s Andras Szabolcs, Cyber Risk Expert, and Peter Szigetvari, Operational Risk Expert, to break down the similarities and differences between two of these new European Union regulations — the Digital Operational Resilience Act, or DORA, and Network and Information Security Directive 2, or NIS2 — how they could affect nearly every company despite their official scope, and how organizations can prepare to comply with them using modern GRC technology.