About
A serial high-tech entrepreneur, my passion is to help large organizations close the gap…
Articles by Nicola (Nick)
Activity
8K followers
-
Nicola (Nick) Sanna shared thisFor more than a decade, the cyber risk profession has been asking one fundamental question: Can cyber risk be measured in business terms? That question has largely been answered. The first chapter of Cyber Risk Quantification (CRQ) proved that cyber risk can be quantified with rigor and consistency. The second chapter focused on communication—giving CISOs, CFOs, CROs, and boards a common language to discuss cyber risk in economic terms rather than technical metrics. Now we are entering the third chapter. Risk Intelligence. The challenge is no longer producing better risk reports. The challenge is enabling better decisions. Organizations are moving beyond periodic assessments and static reporting toward continuous risk intelligence—understanding how changing threats, exposures, AI adoption, third-party dependencies, regulations, and business conditions affect risk in real time. This shift is being accelerated by AI. As AI becomes embedded across the enterprise, leaders must answer new questions: • How do we balance innovation with resilience? • Where should we invest to reduce risk most effectively? • How do we continuously adapt to changing risk conditions? • How do we make better decisions under uncertainty? These are exactly the questions FAIRCON26 will tackle. This year’s conference brings together practitioners, CISOs, CROs, CFOs, CIOs, board members, regulators, academics, and risk leaders to explore how organizations are transforming cyber and AI risk into a strategic decision-making capability through dedicated Practitioner and CXO tracks. The future belongs to organizations that operationalize risk intelligence—not just risk reporting. 📍 FAIRCON26 📅 October 6–7, 2026 📍 New York City Early Bird registration is now open. I hope you’ll join us as we explore the future of cyber and AI risk management and risk-informed decision-making. Register today: https://lnkd.in/g6HisRhH #FAIRCON26 #CyberRisk #CyberRiskManagement #CRQ #FAIRInstitute #RiskIntelligence #ArtificialIntelligence #CISO #BoardRisk #ThirdPartyRisk #CyberSecurity
-
Nicola (Nick) Sanna shared thisGartner’s New CRQ Report Signals a Major Milestone for the Cyber Risk Profession For years, the cybersecurity industry debated whether cyber risk could truly be quantified. Gartner’s new report, Innovation Insight for Cyber Risk Quantification, is another strong signal that the debate has largely been settled. Today, organizations are using Cyber Risk Quantification (CRQ) to support investment decisions, communicate with boards, meet regulatory expectations, and align cybersecurity with business priorities. What I found most interesting about Gartner’s perspective is its focus on what comes next. The future of cyber risk management is not simply about producing more accurate risk reports. It is about operationalizing cyber risk intelligence and embedding it into everyday decision-making. Leading organizations are moving: • From point-in-time assessments to continuous risk intelligence • From technical metrics to business outcomes • From reporting risk to managing risk • From quantification to decision support In many ways, cyber risk quantification is evolving into a broader discipline of cyber risk management—one that helps organizations continuously prioritize actions, allocate resources, improve resilience, and make better business decisions. This evolution becomes even more important as boards, regulators, insurers, and business leaders demand a more defensible understanding of cyber and AI-related risk. It’s encouraging to see Gartner recognize both how far the profession has come and where it is headed next. The question is no longer whether cyber risk can be quantified. The question is how effectively organizations can operationalize that intelligence to drive better decisions. More on this here: https://lnkd.in/g6mq6v5n #CyberRisk #CRQ #FAIR #RiskManagement #CyberSecurity #CISO #AIRisk #FAIRInstitute #FAIRCON26
-
Nicola (Nick) Sanna shared thisGartner finally weighs in on CRQ! Agree with Lampis's remarks and the content of the newly published research document. The debate is no longer whether cyber risk can be quantified, but whether organizations can operationalize those insights to influence real business decisions. At the FAIR Institute, we’ve seen the organizations realizing the greatest value from CRQ are those that connect quantification directly to business priorities, investment decisions, and executive accountability. Quantification is the enabler; better decisions are the outcome.Nicola (Nick) Sanna shared thisFor years we argued about whether to quantify cyber risk. That argument is over. Done well, CRQ works. But a beautifully quantified cyber risk that changes nothing is still a bad cyber risk decision. What separates #CRQ programs that drive decisions from those that don't, is operational credibility rather than model sophistication. We explore this in "Innovation Insight for Cyber Risk Quantification" together with Pedro Pablo Perea de Dueñas and Deepti Gopal.
-
Nicola (Nick) Sanna shared thisComing to the Gartner Security & Risk Summit next week? Needing to find a way to assess your exposure to AI tools such as ChatGPT, Claude, Copilot, etc.? We can help... DM or see me at the SAFE booth.
-
Nicola (Nick) Sanna shared thisAutonomous TPRM can reduce the Total Cost of Ownership of third-party risk management by close to 50%. Why? Because most TPRM programs today still depend on a linear scaling model: More vendors → more analysts → more operational cost. That model is breaking. Enterprises now depend on hundreds — often thousands — of SaaS, cloud, API, and AI vendors like ChatGPT, Claude, Gemini, and Copilot. But most TPRM teams are still operating through manual questionnaires, point-in-time assessments, and fragmented workflows. AI changes the equation. The future of TPRM is not more headcount. It’s: ✔️ Autonomous assessments ✔️ Continuous monitoring ✔️ AI-driven evidence collection ✔️ Real-time vendor risk visibility ✔️ Business-impact-based prioritization This is not incremental automation. It’s a fundamental shift in the economics of TPRM: • Lower operating cost • Faster onboarding • Expanded vendor coverage • Continuous oversight • More defensible cyber risk management TPRM is evolving from a compliance process into an autonomous cyber risk management function. Read the full blog here: https://lnkd.in/eidPeZmm
-
Nicola (Nick) Sanna shared thisI had the pleasure of joining Neila Zerguini (Deloitte) and Eric ROBIN (Hydro-Québec) at the CyberEco Conference Montreal last week to discuss a topic that is quickly becoming central in every boardroom: Cyber risk in the era of emerging risks — especially AI. A big thank you to Deloitte for the invitation and for bringing together such a thoughtful discussion. A few takeaways — and a strong point of view: 1. We are not keeping up — We need to change the model Cyber risk is evolving continuously. Our governance models? Still largely periodic. The gap is real. The organizations making progress are not trying to “go faster” — they are redesigning how risk is managed: → From periodic reporting → continuous decision-making → From technical signals → business-impact risk scenarios → From expert opinion → defensible quantification The goal is not to match the speed of the adversary. It’s to build a system that can absorb that speed. 2. AI doesn’t just introduce new risks — it breaks old approaches AI is accelerating everything: • Attack capability • Innovation cycles • Third-party dependencies Which means: Point-in-time, manual, siloed risk management is structurally outdated. We’re seeing a fundamental shift toward: → Continuous, data-driven risk evaluation → Automation at scale → Scenario-based thinking → Real-time prioritization This is not evolution. It’s a reset. 3. Cyber risk is not a cost problem — it’s a capital allocation problem One of the most important reframes: Every cyber decision is an economic decision. → Where do we invest? → What risk do we accept? → What enables growth safely? Especially with AI, the question is not: 👉 “Should we adopt it?” It’s: 👉 “How do we adopt it with a level of risk that is economically acceptable?” That’s where quantification changes the conversation — from compliance… to decision-making. 4. The real challenge isn’t just technology — it’s also alignment Technology is part of the equation. But half the challenge is alignment: • A common language of risk across the organization • A clear risk appetite • A continuous feedback loop between operations and governance The organizations that get this right turn cyber risk into a shared decision framework, not a siloed conversation. Final thought: In 5 years, we’ll look back and wonder how we managed cyber risk with: • Static reports • Control checklists • Spreadsheets The future is: → Continuous → Autonomous → Business-aligned And most importantly: 👉 Focused on decisions — not signals. Curious to hear how others are thinking about this shift — especially as AI reshapes both risk and opportunity.
-
Nicola (Nick) Sanna shared thisMost organizations still think about third-party risk as a vendor management problem. That mindset is now dangerously outdated. In this article I co-authored with Alexander Antukh, we explore a fundamental shift: 👉 Third-party risk is no longer a supporting function—it is now a primary driver of enterprise risk exposure And AI is accelerating that shift. Today’s “vendors” are no longer just service providers. They are: • Embedded into core business workflows • Processing sensitive data • Influencing decisions and automation • Continuously evolving systems Which means the real question is no longer: “Are our vendors compliant?” It’s: 👉 “Do we understand—and continuously manage—the risk created by our extended, AI-driven ecosystem?” The leaders getting this right are making a decisive shift: • From manual → automated • From periodic → continuous • From reactive → proactive • From vendor-centric → ecosystem-aware This isn’t a tooling evolution. It’s an operating model transformation for cyber risk. If you're a CISO, board member, or risk leader, this is the conversation you need to be having now. Read the full article here:
-
Nicola (Nick) Sanna shared thisCollaboration is a force multiplier in cybersecurity. Roni H Angel said it well—I couldn’t agree more. What makes this partnership with the Verizon cyber risk team so exciting isn’t just alignment at the management level—it’s the shared ambition to fundamentally change how cyber risk is managed, measured, and delivered to the business. Together, we’re not just improving internal security and risk operations—we’re bringing to market a new model: managed, autonomous cyber risk management services that allow enterprises to: • Understand cyber risk in true business terms • Continuously monitor and manage that risk across their extended enterprise • Scale without adding operational burden This is where the industry needs to go—and doing it alongside a partner like Verizon, with their global reach and deep customer trust, is incredibly powerful. Thank you Mike K., Roni H Angel, Hani Omar, John H. Mooney and team for hosting such a thoughtful and forward-looking session. And thank you to Chris Griffith, VP Product Management at Safe Security for leading this partnership on the SAFE side. This is exactly what it looks like when vision, execution, and partnership come together to drive real change. The future of cyber risk management won’t be built in silos. It will be built together.Nicola (Nick) Sanna shared this🤝Collaboration is a force multiplier in cybersecurity. This week, we hosted a strategic workshop with our partners, including their President and VP of Products, focused on deepening our partnership and advancing the development capabilities that will meaningfully improve how our team operates. The most effective security programs aren't built in isolation, they're built through intentional partnerships with organizations that are as invested in your success as you are. Sessions like this one are a reminder of what's possible when leadership alignment meets shared purpose. Grateful for the caliber of leadership in the room. Thank you Mike K., Hani Omar, Nicola (Nick) Sanna, and Chris Griffith for bringing both vision and candor to the table. Also, shoutout to those who joined us remotely, your contributions were just as valuable. This is what meaningful partnership looks like. #Cybersecurity #ExecutiveLeadership #Partnership #SecurityStrategy #Innovation #DigitalTransformation #TechLeadership #ProductInnovation #BusinessGrowth #TeamWork
-
Nicola (Nick) Sanna shared thisExcited to share the release of the 2026 NACD Cyber Risk Oversight Handbook—a resource I’m proud to have contributed to in collaboration with the NACD (National Association of Corporate Directors) and the Internet Security Alliance. In a world where AI is rapidly becoming one of the most important drivers of both growth and risk, this handbook is not just timely—it’s essential. For board directors, the conversation has shifted: It’s no longer “Do we have cyber risk under control?” It’s “Do we understand how cyber and AI risk are shaping enterprise value—and are we governing accordingly?” 🔑 Three Takeaways for Boards 1. Cyber & AI Risk Are Now Strategic Business Risks Cybersecurity—and increasingly AI risk—must be framed in economic terms. Boards need visibility into financial exposure, trade-offs, and impact on enterprise value, not just technical metrics. 2. Third-Party & AI Vendor Risk Is a Board-Level Priority From platforms like generative AI to deeply embedded digital suppliers, risk now lives across an extended enterprise. Comprehensive oversight over this expanded attack surface is critical. 3. Governance Must Evolve from Static to Continuous Periodic reviews are no longer sufficient. Boards should push for continuous, data-driven, and increasingly autonomous risk management to keep pace with real-time change. A big thank you to the leaders who helped bring this to life and launched it at yesterday’s press conference at EY’s Washington, DC office: Peter Gleason, Larry Clinton, Dylan Sandlin, JR Williamson, Gregory Touhill. This handbook is a must-have for any board director looking to elevate oversight of cybersecurity and AI risk. 👉 Download it here: https://lnkd.in/en_9Fta8 #CyberRisk #AIRisk #BoardLeadership #CorporateGovernance #NACD #FAIRInstitute #Cybersecurity
-
Nicola (Nick) Sanna liked thisNicola (Nick) Sanna liked thisThis was a fun surprise. Not your standard “Quota Crusher” or other award plaque we have all seen posted. This one to me signifies the partnerships that have been built with my customers over the years. Have a great day all!
-
Nicola (Nick) Sanna liked thisNicola (Nick) Sanna liked thisI’m honored to share that I’ve joined Allied Universal as Global Chief Information Security Officer! Allied Universal’s purpose—serving and helping safeguard customers, communities and people—deeply resonates with me. At an organization operating across more than 100 countries and territories, protecting our people, systems, data and technology platforms is essential to serving customers and supporting responsible growth. Cybersecurity is a shared responsibility. It requires strong governance, operational readiness, transparency and close collaboration across technology, legal, operations and the business. I look forward to working with colleagues around the world to strengthen Allied Universal’s cyber resilience and protect it’s critical assets against evolving threats. I’m grateful to the Allied Universal leadership team for their confidence, as well as to the colleagues and mentors who have helped shape my journey. I look forward to carrying those lessons and relationships with me into this next chapter. #AlliedUniversal #Cybersecurity #GCISO #Leadership
-
Nicola (Nick) Sanna liked thisNicola (Nick) Sanna liked thisI'm back with some of the best in the biz and I've joined Empirical Security! What problem are we solving? A "7.5 out of 10" looks the same whether it was exploited yesterday or never at all. Whether you're a hospital or a hotel chain. Whether it's wide open to the internet or buried three layers deep behind controls nobody's touched in years. Same score. Wildly different reality. AI is generating more exposures than ever (ICYMI at BlackHat 🤣) but "fix more" isn't the answer- it never was. The real question has always been: who can fix what actually matters? This is what Empirical Security is all about. Read more below but 2012 Molly is very excited about what 2026 Molly is up to 🤠 Ed Bellis Michael Roytman Jay Jacobs Greg Howard https://lnkd.in/gRUXDVVeKinda Chic to Prioritize with Proof | Empirical SecurityKinda Chic to Prioritize with Proof | Empirical Security
-
Nicola (Nick) Sanna liked thisNicola (Nick) Sanna liked this"Cyber risk quantification is the most important skill in cybersecurity. Change my mind." That's the sign Tony Martin-Vegue and I will be sitting behind at Black Hat on Tuesday. Somehow that's a controversial take. It shouldn't be, no more than compound interest is. Tony wrote From Heatmaps to Histograms (just out...destined to be a classic), and I wrote The Metrics Manifesto and co-authored How to Measure Anything in Cybersecurity Risk. The books don't mean we are right... just that we hate trees, or perhaps need to get a life? Come take the other side of the argument. There's a beer in it for whoever changes our minds. Hussongs at Mandalay Place. Tuesday August 4, 4:30 to 6:00. On the walkway between Mandalay Bay and Luxor.
-
Nicola (Nick) Sanna liked thisNicola (Nick) Sanna liked thisEdit: Venue change! Hussong’s Cantina, a few doors down. "Cyber risk quantification is the most important skill in cybersecurity. Change my mind." That's the sign Richard Seiersen and I will be sitting behind it at Black Hat on Tuesday. Somehow that's a controversial take. It shouldn't be, no more than compound interest is. Richard wrote The Metrics Manifesto and co-authored How to Measure Anything in Cybersecurity Risk. I wrote From Heatmaps to Histograms, which is not the same thing as being right. Come take the other side. There's a beer in it for whoever changes our minds. Rí Rá, Mandalay Place. Tuesday August 4, 4:30 to 6:00. On the walkway between Mandalay Bay and Luxor.
-
Nicola (Nick) Sanna liked thisI am thrilled to share that I have officially started my new role as Executive Assistant to the CEO at W. L. Butler! While I am only a couple of weeks into the position, I am already incredibly impressed by the company culture and deeply appreciate the warm welcome from everyone I have met so far. I look forward to partnering with such a talented group of people. I want to extend my sincere gratitude to my professional network. To everyone who submitted referrals, offered guidance, and supported me throughout my search, your mentorship and kindness made all the difference. I am truly grateful for this community and excited for this next long awaited chapter. #NewJob #CareerUpdate #ExecutiveAssistant #WLButler #ProfessionalNetwork #Gratitude
Experience & Education
Licenses & Certifications
Publications
Courses
-
Introduction to Philosophy, Theology and Spirituality - Istituto Internazionale Mystici Corporis - 1991/3
-
-
Scaling up your venture - Stanford Graduate School of Business - 2014 (Professors Huggy Rao and Robert Sutton)
-
Languages
-
English
Native or bilingual proficiency
-
French
Native or bilingual proficiency
-
Italian
Native or bilingual proficiency
-
German
Professional working proficiency
-
Spanish
Limited working proficiency
Recommendations received
6 people have recommended Nicola (Nick)
Join now to viewOther similar profiles
Explore more posts
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content