Stephen Hurren - Cyber Risk Management Explained: Seeing Around Corners | The Outbound Edge: Ep 3

Cyber risk management is not a tick-box exercise. Outbound Group's CISO Stephen explains how to see around corners, set your risk appetite and turn security into a genuine business enabler. In this episode of The Outbound Edge, host Keith Bucknall sits down with Stephen, Outbound's Chief Information Security Officer, to unpack what risk management actually means beyond the paper exercise. If you own or run a business, sit on a board, or lead IT, this conversation translates cyber and information security risk into plain business language. You will learn how to frame a real risk using cause, event and outcome, how to set a sensible risk appetite and risk tolerance, and who should actually own risk (including the role of the Senior Information Risk Owner and where the CISO fits in). Stephen also makes the case that a well-built Excel risk register can outperform expensive GRC tooling and breeze through an ISO 27001 audit. We get practical on disaster recovery, business continuity and why testing your backups matters far more than simply having them. Stephen explains why tabletop exercises change the way whole teams think, and why the question is not if an incident happens but when. The conversation also covers the modern risk surface: shadow IT and SaaS ownership, supplier due diligence and the shared responsibility model, why Cyber Essentials is getting harder, and how AI is reshaping identity, trust and the threat landscape. The closing message is simple: good risk management protects your business and wins you business. Perfect for MSP leaders, business owners, managing directors, finance and operations leaders, and IT decision makers who want confidence, not jargon. This Eipsode will go through: 00:00 Intro: what seeing around corners means 00:40 Meet Stephen, Outbound's CISO 01:05 What is risk management, really? 03:13 Cause, event and outcome: framing a real risk 05:53 Risk tolerance and risk appetite explained 06:43 Who owns risk? The SIRO and board accountability 09:36 Why a good Excel risk register can beat pricey GRC tools 11:17 IT risk vs business risk 13:04 The $10.5 trillion cybercrime stat 13:35 How risk management underpins ISO 27001 15:16 Disaster recovery, BCP and testing your backups 16:49 The power of tabletop exercises 20:30 Who should own risk day to day? 21:56 Shadow IT and owning SaaS risk 23:40 Supplier due diligence and shared responsibility 26:06 Building a risk framework from scratch 28:36 Is AI changing the risk landscape? 31:25 Why Cyber Essentials is getting harder 33:10 Closing thoughts: security as a business enabler 👉 Watch the full series and get in touch with the Outbound Group team here: https://visit-our.link/ZgDiMaF 🔔 Subscribe for more straight-talking technology and security conversations:    / @outboundgroup   Follow Outbound Group:   / theoutboundgroup     / theoutboundgroup     / outbound_group   https://x.com/outboundgroup #CyberRiskManagement #CyberSecurity #ISO27001