NORA
Resources

Clear Thinking on Risk

Guides and perspectives from practitioners who have run risk assessments at scale.

Whitepapers

The deeper read

Why Risk Assessments Fail and What to Do About It

Most risk assessments are built to satisfy an auditor, not surface a risk. This guide explains the structural failures behind that pattern — and how to fix them.

Perspectives

From the field

The Question Your Risk Assessments Are Never Asking

Risk assessors ask the right compliance questions. But compliance questions and risk questions aren't the same thing — and the gap between them is where exposure hides.

Read Article

Why 'We Have Controls in Place' Is Not the Same as 'Our Controls Are Working'

The most common answer in a risk assessment is also the least informative. Here's what the right questions actually surface.

Read Article

What a $5M SaaS Platform and an Internal Spreadsheet Have in Common on a Risk Assessment

Both get the same question on a risk assessment. Neither question was designed to understand either one.

Read Article

How to Explain a Cyber Risk Score to a Board That Doesn't Speak Cybersecurity

The problem isn't that boards don't understand risk. It's that most risk scores weren't built to be understood.

Read Article