Building a Cyber Risk Management Program

I’ll admit, I approached this audiobook with skepticism—another “cybersecurity for leaders” tome promising to simplify the impossible? But Brian Allen won me over with his knack for making intangible risks feel real. His chapter on “risk appetite” isn’t some abstract corporate-speak exercise; it’s a brutal dissection of how companies rationalize ignoring obvious threats (looking at you, 2021’s Log4j panic). The case studies are the highlight here, especially the deep dive into a mid-sized manufacturer that got breached because they treated IT security like a checkbox. Allen’s writing is sharp, but Mike Lenz’s narration elevates it further. Lenz has a gravelly, authoritative voice that sounds like the guy you’d want on your incident response team during a midnight breach call. His pacing is excellent, though I did find myself wishing for a PDF companion in a few sections—those flowcharts and risk matrices would’ve been easier to follow with a visual. My biggest gripe? The book occasionally veers into textbook territory, with long-winded sections on governance structures that feel more like filler than practical advice. And while Allen’s real-world examples are gold, the lack of industry-specific deep dives (e.g., healthcare vs. finance) makes it feel a bit one-size-fits-all. Still, for the price and the sheer utility of the content, this is a standout in a crowded genre. If you’re a security leader who’s tired of PowerPoints and buzzwords, Allen and Lenz give you the tools—and the stomach—to build a program that doesn’t crumble at the first sign of trouble.