Why is everything a ‘risk’ problem all of a sudden?

I have noticed all security teams just dump things on the Information Security Risk function, without giving it much thought. Mainly I assume their motivation is that they don’t have to follow up on any security issues in the organization. Somehow magically risk is supposed to chase everyone and everything down.

This has been my experience working at 2 large Canadian organizations (not financial institutions) in senior cyber risk roles for 4 years. Assuming this problem isn’t just following me, …

canadian cyber cyber risk cybersecurity don down experience financial financial institutions function information information security institutions large motivation organization organizations problem risk roles security security issues security risk security teams teams things thought working