Ensuring Risk Assessments have a (Business) Impact

The article reviews existing risk frameworks (ISO31000, ISO27005, NIST SP800-30, OCTAVE, FAIR) and proposes a hybrid approach that enhances FAIR with additional variables and a 'What, Who, How' conversation—linking business-critical assets, likely adversaries, and technical adversary simulation—to produce more actionable qualitative, semi-quantitative, and quantitative risk assessments for executives.