Ditching Traffic-Light Risk Models - Jon Villanti - Cyber Smokehouse - Episode #32
#32

Ditching Traffic-Light Risk Models - Jon Villanti - Cyber Smokehouse - Episode #32

Take your security program, board reporting, and risk management strategies to the next level with tactical insights on cyber risk quantification, agentic AI deployment, and enterprise governance. It’s time to stop relying on subjective traffic-light risk matrices and start speaking the language of financial impact that boardrooms understand. Who better to guide you through this transition than retired Air Force lieutenant colonel, F-16 fighter pilot, former SANS instructor, and 3-time bank CISO, Jon Vallanti?

You will learn why the traditional COSO three lines of defense model fails in modern cybersecurity, how to leverage internally hosted open-weight AI models to protect sensitive financial data, and why OT&E (Organize, Train, Equip) is the ultimate blueprint for security leadership. Get motivated to eliminate guesswork, challenge legacy audit frameworks, and harness AI to scale your SOC and defend against next-generation cyber threats!

Takeaways:

  • Quantifying Risk in Dollars Over Traffic Lights: CISOs must move away from 1-to-5 scales or green/yellow/red heatmaps; board members understand financial ranges and dollar impact.
  • The Flaw in COSO’s Three Lines of Defense: Separation of duties between IT and Information Security under traditional COSO frameworks often starves security of operational agility; flexibility in governance is essential.
  • Self-Hosted Open-Weight AI Models: For regulated sectors like banking, internally hosted open-weight models solve data privacy and guardrail drift issues inherent in public LLM APIs.
  • Deploying Internal Tripwires & Honeypots: As adversaries adopt AI-augmented tools, deploying internal decoys and tripwires is critical for early detection before lateral movement occurs.
  • Leadership through OT&E (Organize, Train, Equip): Military-grade leadership centers on getting the right people on the bus, investing in high-end technical training, and equipping teams to win.

Quote of the Show:

"Cyber is risk, and everything we do is about uncertainty. We need to move away from low-medium-high scales and talk to the board in dollars - it’s a game of removing uncertainty, not chasing perfection." - Jon Vallanti


Links:

Ways to Tune In: