GRC accelerated security maturity, then stalled: we started optimizing for green dashboards and happy auditors instead of resilience. This session, based on the DVMS Institute’s Governing by Assurance series, introduces GRAA (Governance, Resilience, Assurance, Accountability) and replaces “am I compliant?” with “how resilient am I to ransomware?” With complexity outpacing governance, executives facing personal liability, and tools like Tanium, Armis, and Veza now enumerating reality in near real time, the speaker shows why siloed, vulnerability-based views must give way to attack path-based views, and how the shift extends to financial and operational resilience. Although the session is framed around cyber, the concepts extend to financial and operational resilience, so attendees from any discipline will leave with a new way to measure what their tooling is actually telling them. 

Additional details