# risk-management A continuous process for identifying, analyzing, treating, and monitoring risks to projects, systems, or organizational operations. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## NFR Brain: challenging the status quo of risk management with data DevFeed: [NFR Brain: challenging the status quo of risk management with data]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-09-04T14:18:41Z Content type: opinion Language: en Sources: [Nubank]() Topics: [risk-management](), [data](), [Risk](), [Resilience]() Tags: [critical](), [data](), [data-analytics](), [data-modelling](), [data-science-machine-learning](), [governance](), [models](), [risk-management]() ### AI overview Nubank describes NFR Brain, a platform for combining data, modelling, and expert judgement to make non-financial risk signals comparable and actionable. The article presents it as a way to support more consistent, transparent risk prioritization in business decisions without automating judgement. ### Source excerpt Author : Mayara Zenati At Nubank, we believe the most meaningful problems for customers and for the business rarely come with ready-made answers. That is why we challenge the status quo: not to innovate for innovation's sake, but to remove complexity and build solutions that make important decisions simpler, faster and better. This mindset also [...] The post NFR Brain: challenging the status quo of risk management with data appeared first on Building Nubank. ## NFR Brain: challenging the status quo of risk management with data DevFeed: [NFR Brain: challenging the status quo of risk management with data]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-09-04T14:18:41Z Content type: article Language: en Sources: [Nubank]() Topics: [risk-management](), [data](), [Resilience](), [incident]() Tags: [business](), [complexity](), [data](), [data-analytics](), [data-science-machine-learning](), [management](), [resilience](), [risk](), [risk-management](), [service]() ### AI overview Nubank is building NFR Brain, a platform that combines data, modelling and expert judgement to create a comparable and actionable view of non-financial risk. The article explains how the platform is intended to support clearer, more consistent prioritization across operational failures, customer complaints, third-party dependencies and other risk signals. ### Source excerpt Author : Mayara Zenati At Nubank, we believe the most meaningful problems for customers and for the business rarely come with ready-made answers. That is why we challenge the status quo: not to innovate for innovation's sake, but to remove complexity and build solutions that make important decisions simpler, faster and better. This mindset also [...] The post NFR Brain: challenging the status quo of risk management with data appeared first on Building Nubank. ## Canon 3X: Explore/Expand/Extract DevFeed: [Canon 3X: Explore/Expand/Extract]() Original publisher: [Read original article]() Author: Kent Beck Published: 2026-07-30T13:04:07Z Content type: opinion Language: en Sources: [Software Design: Tidy First?]() Topics: [implementation](), [risk-management](), [Finance](), [Business Security]() Tags: [implementation](), [management](), [project-management](), [risk-management]() ### AI overview Kent Beck explains the 3X framework of Explore, Expand, and Extract, arguing that each phase of a product or company's growth requires different approaches to finance, teams, project management, technology, risk management, implementation, marketing, and sales. ### Source excerpt I've started a series of Canon articles where I explain my ideas as plainly & unambiguously as possible--no analogies, no persuasion, just the facts. ## How Nubank uses causality, machine learning and Python to support credit limit increase decisions DevFeed: [How Nubank uses causality, machine learning and Python to support credit limit increase decisions]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-07-01T16:16:31Z Content type: article Language: en Sources: [Nubank]() Topics: [Data Science](), [Machine Learning & Artificial Intelligence](), [Python](), [risk-management](), [Monitoring](), [Optimization]() Tags: [causality](), [data-science](), [life-at-nu](), [machine-learning](), [monitoring](), [optimization](), [python](), [risk](), [scalability]() ### AI overview A high-level technical overview of how Nubank applies data science, predictive modeling, causality, optimization, and monitoring to support credit limit increase decisions. It discusses balancing customer experience, risk management, operational sustainability, interpretability, computational cost, and scalability. ### Source excerpt A technical, high-level view of how data science helps build more responsible and scalable credit decisions The post How Nubank uses causality, machine learning and Python to support credit limit increase decisions appeared first on Building Nubank. ## Maintenance of Everything : A Review DevFeed: [Maintenance of Everything : A Review]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-04-18T10:45:19Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [maintenance](), [risk-management](), [reliability](), [Security]() Tags: [cybersecurity](), [maintenance](), [reliability](), [review](), [risk-management](), [security](), [technology]() ### AI overview A review of Stewart Brand's book Maintenance of Everything, discussing the importance of maintenance in technology risk management, security, and reliability. It also questions cybersecurity benchmarking that focuses on inputs such as budgets instead of outcomes such as control effectiveness. ### Source excerpt I haven't done a book review for a while and there's no better way to get back to this than a look at Stewart Brand's Maintenance of Everything . Stewart developed a lot of this book in an open editing process and so the final delivery of what is Part 1 of a forthcoming series was all the more anticipated. I've long been obsessed with the need for maintenance in the context of technology risk management, security and reliability. A big part of technical debt build up and the security... ## What the Swedbank outage reveals about the limits of traditional change management DevFeed: [What the Swedbank outage reveals about the limits of traditional change management]() Original publisher: [Read original article]() Author: Bruce Johnston Published: 2023-08-16T16:05:12Z Content type: opinion Language: en Sources: [High Scalability]() Topics: [incident](), [risk-management]() Tags: [banking](), [incident](), [management](), [outage](), [risk-management]() ### AI overview The article examines the Swedish FSA's judgment on Swedbank's April 2022 outage, which followed an unapproved IT change and affected customer balances and payments. It argues that traditional change-management controls, including manual approvals and change meetings, do not by themselves guarantee safe and secure changes. ### Source excerpt This week I've been reading through the recent judgment from the Swedish FSA on the Swedbank outage. If you're unfamiliar with this story, Swedbank had a major outage in April 2022 that was caused by an unapproved change to their IT systems. It temporarily left nearly ## Worthwhile Books Q4 2022 DevFeed: [Worthwhile Books Q4 2022]() Original publisher: [Read original article]() Author: Adam Published: 2022-12-19T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security & Privacy](), [Cybersecurity](), [risk-management]() Tags: [books](), [cybersecurity](), [risk-management](), [safety]() ### AI overview A personal roundup of books read in late 2022, highlighting works about safety, maritime disaster, engineering, risk management, science, fiction, and astrobiology. The author emphasizes lessons that transfer from safety to cybersecurity. ### Source excerpt Books that I read in the fourth quater that are worth your time include several about safety with lessons for cybersecurity ## Application Security Roundup - June DevFeed: [Application Security Roundup - June]() Original publisher: [Read original article]() Author: Adam Published: 2022-06-28T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Requirements](), [risk-management](), [Cybersecurity]() Tags: [application-security](), [medical-devices](), [requirements](), [risk-management](), [security]() ### AI overview A June application security roundup highlights articles about requirements for medical-device cybersecurity, policy and implementation, and the importance of appropriate risk management and investigation despite concerns about cost and delay. ### Source excerpt Interesting appsec posts: from medical devices to bridges. ## Learning Lessons from Aviation DevFeed: [Learning Lessons from Aviation]() Original publisher: [Read original article]() Author: Adam Published: 2021-11-15T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [recommendations](), [risk-management]() Tags: [aviation](), [investigations](), [recommendations](), [report](), [research](), [security](), [third-party]() ### AI overview The article discusses applying learning models from aviation to cybersecurity investigations. It describes a report examining what a cyber NTSB might be, recommends objective and independent investigations, and identifies research questions for further study. ### Source excerpt The definition of insanity is doing the same thing over and over and expecting different results. We can do better, and a major new report explains how. ## What are we going to do: CO2 edition DevFeed: [What are we going to do: CO2 edition]() Original publisher: [Read original article]() Author: Adam Published: 2021-10-05T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [risk-management](), [Cybersecurity](), [Microsoft]() Tags: [analysis](), [bypass](), [carbon](), [climate](), [cost](), [cybersecurity](), [ease](), [emissions](), [microsoft](), [risk-management](), [usability]() ### AI overview The article uses Microsoft's evaluation of carbon-removal proposals to discuss how explicit criteria can improve mitigation and risk-management decisions. It applies this idea to cybersecurity threat modeling, including cost, bypass resistance, usability, and unusual circumstances. ### Source excerpt What happened when Microsoft tried to buy climate abatements ## Zen and the art of not quantifying risk DevFeed: [Zen and the art of not quantifying risk]() Original publisher: [Read original article]() Author: Adam Published: 2021-07-27T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [risk-management](), [Security](), [Architecture & Design](), [Development](), [API]() Tags: [api](), [development](), [dialog](), [meetings](), [risk](), [risk-management](), [security]() ### AI overview The article argues that threat modeling should not focus on producing precise risk numbers. Instead, security teams should work with development and operations on prioritization, using simpler relative sizing when appropriate. This approach can reduce conflict and help address easily fixed lower-priority issues alongside larger changes. ### Source excerpt Many people want their threat modeling work to produce risk numbers, and in this post you'll learn why that's a mistake. ## Review: Practical Cybersecurity Architecture DevFeed: [Review: Practical Cybersecurity Architecture]() Original publisher: [Read original article]() Author: Adam Published: 2021-05-26T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Architecture & Design](), [Application Security](), [risk-management]() Tags: [analysis](), [application-security](), [architecture](), [practical](), [review](), [risk](), [risk-management]() ### AI overview Adam Shostack reviews Practical Security Architecture by Diana Kelley and Ed Moyle, praising its concise, practical, customer-focused approach to security architecture. He also discusses its treatment of application security, risk management, and threat modeling, including his view that likelihood can often be simplified when analyzing public-facing applications. ### Source excerpt Adam Shostack's review of the book Practical Cybersecurity Architecture ## Includes No Dirt: Healthcare Threat Modeling (Thursday) DevFeed: [Includes No Dirt: Healthcare Threat Modeling (Thursday)]() Original publisher: [Read original article]() Author: Adam Published: 2019-10-31T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Security & Privacy](), [risk-management](), [Development]() Tags: [development-process](), [healthcare](), [risk](), [risk-management](), [security](), [security-privacy]() ### AI overview A commentary on the "Includes No Dirt" threat modeling approach by William Dogherty and Patrick Curry of Omada Health. The article describes its focus on security, privacy, and compliance, outlines the NO DIRT model and supporting worksheets, and discusses its potential use in development and vendor risk management. ### Source excerpt "Includes No Dirt" is a threat modeling approach by William Dogherty and Patrick Curry of Omada Health, and I've been meaning to write about it since it came out. ## A roundup of articles and papers on risk management, security automation, SDL, and threat modeling DevFeed: [A roundup of articles and papers on risk management, security automation, SDL, and threat modeling]() Original publisher: [Read original article]() Author: Adam Published: 2019-10-15T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [risk-management](), [Security](), [Automation]() Tags: [academics](), [automation](), [devices](), [governance](), [paper](), [risk](), [risk-management](), [sdl](), [security]() ### AI overview This blog post highlights several readings on cybersecurity, including a risk management and governance knowledge area, automated security design flaw detection, lessons from 15 years of SDL, and threat modeling for devices. ### Source excerpt Just what the title says. ## Safety and Security in Automated Driving DevFeed: [Safety and Security in Automated Driving]() Original publisher: [Read original article]() Author: Adam Published: 2019-07-08T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [autonomous vehicles](), [Security](), [risk-management](), [Cybersecurity](), [Architecture & Design]() Tags: [automotive](), [autonomous-vehicles](), [driving](), [risk](), [risk-management](), [safety](), [security](), [systems]() ### AI overview This commentary examines how cybersecurity can be integrated into the established safety discipline for automated driving. It discusses threat modeling, minimal risk conditions, emergency stops, risk-treatment strategies, and risks associated with generic vehicle architectures. ### Source excerpt Let's explore the risks associated with Automated Driving. ## Recommended Reads on IT Security, Cybersecurity, and Organizational Resilience DevFeed: [Recommended Reads on IT Security, Cybersecurity, and Organizational Resilience]() Original publisher: [Read original article]() Author: Adam Published: 2017-08-14T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [IT\_Security](), [Cybersecurity](), [Business Security](), [risk-management]() Tags: [culture](), [it-security](), [management](), [risk](), [risk-management](), [security](), [weather]() ### AI overview A curated selection of long, thought-provoking reads covering IT security, cybersecurity risk management for the U.S. government, and company culture for handling failure. ### Source excerpt Each of these is long and thought-provoking and worth savoring. ## Introducing Cyber Portfolio Management DevFeed: [Introducing Cyber Portfolio Management]() Original publisher: [Read original article]() Author: Adam Published: 2017-02-21T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [risk-management](), [Security](), [Business Security]() Tags: [challenges](), [communication](), [management](), [portfolio](), [risk-management](), [security](), [strategy](), [talk]() ### AI overview The article introduces Cyber Portfolio Management, a proposed approach to driving effective security programs by managing distributed security portfolios and improving communication between security and business teams. It also discusses a related RSA talk, audio and slides, and an upcoming ebook draft. ### Source excerpt [no description provided] ## The art of the startup pivot from a founder-CTO point of view DevFeed: [The art of the startup pivot from a founder-CTO point of view]() Original publisher: [Read original article]() Author: Yann Lechelle Published: 2015-04-30T13:15:07Z Content type: opinion Language: en Sources: [eFounders]() Topics: [risk-management](), [Business Security]() Tags: [efounders](), [management](), [risk-management](), [startup](), [startups](), [tech]() ### AI overview An opinion piece examines startup pivots from a founder-CTO perspective, covering why strategic changes occur, their effects on founders, investors, revenue, and company structure, and how repeated pivot experience may inform risk management. ### Source excerpt A risk management perspectiveYann Lechelle (LinkedIn, Twitter) is a Paris-based entrepreneur with a number of pivots under his belt. He was founder and CEO at Etheryl (acquired by private investors), co-founder at KickYourApp.com (acquired by Change), co-founder and COO/CTO at Appsfire.com (acquired by MNG), co-founder at Sonetin.com and currently COO at Snips.ai using AI to make technology disappear. Yann occasionally invests in and advises other startups, on pivots among other things!~ TL;DR: this post discusses the generic notion of a startup pivot. Technically minded readers might prefer to focus on the product & tech sections, or anything else in bold. Pivots are a fact of life in the startup world. Yet, very few founders, especially first-time founders, will provision for it. The founder mindset is typically focused on a single go-to-market strategy. The investors are sold on the potential based on that initial strategy, signing off a budget calibrated accordingly. Everyone sings the same tune until the shareholders realize, hopefully before it's too late, that the strategy is going nowhere, and that a radical change is required. This scenario occurs more often than not, over 65% of the time according to Fred Wilson. While this iterative process appears natural, and with the benefit of hindsight, accepted and even praised as part of the startup folklore, it remains a traumatic event from the inside, and possibly a direct cause for failure. Reversely, if done right, a pivot is almost inevitably cause for success. Structurally, there can only be a handful of pivots within the lifetime of a company. Repeat entrepreneurs may have experienced it multiple times and therefore developed their art of the pivot... hence becoming pivot artists, a trait that VCs should consider as key risk management expertise! Here are a few awesome pivot artists: Multi-pivot repeat entrepreneur Stewart Butterfield: from video game to Flickr and from video game to Slack; product & vision p