Conference Updates

March 07, 2022

Gartner Security & Risk Management Summit 2022 India: Day 1 Highlights

We are bringing you news and highlights from the Gartner Security & Risk Management Summit, taking place this week virtually in India. Below is a collection of the key announcements and insights coming out of the conference.

On Day 1 from the conference, we are highlighting the opening keynote, the outlook for security monitoring and operations, and what works and what doesn’t work in vulnerability management.

Key Announcements

Gartner Opening Keynote: Leadership Repositioning for Security Leaders

Presented by Tina Nunno, Distinguished VP Analyst, Gartner

As a security leader, it’s essential to take an offensive approach rather than a defensive one, setting the terms of engagement rather than having them set by others. In her Opening Keynote session, Tina Nunno, Distinguished VP Analyst at Gartner, explored how security leaders can ensure they lead from an offensive position to deliver the best results for themselves and for their enterprises.

Key Takeaways

  • “This is a time of extraordinarily high visibility for security issues and security leadership, and that means this is a unique opportunity to shift your position in the organization.”

  • “Security and risk leaders must not only defend the enterprise but go on the offensive to help the enterprise take advantage of a wide variety of new opportunities to help them respond to an ever-changing world of threats.”

  • “The best coaches in the world are viewed as honest brokers: you’re the person that we can go to when we’re not sure what’s going on and get your advice and expertise to help take us to the next level.”

  • “Go on the offensive and take control of your leadership brand. Think about three words your CEO would use to describe you today, and then how you would prefer they describe you three months from now.” 

  • “Go on the offensive regarding who you work with and what you work on. Focus on partnering with business customers by being clear about their job on the team.”

  • “Coach executives through these tough digital uncertainties in this time of volatility, reframe your culture, embrace your role as that cultural leader, and win together by delivering on cost, revenue and risk.”

Outlook for Security Monitoring and Operations

Presented by Jon Amato, Senior Director Analyst, Gartner

Cybercrime is a rapidly growing business and security operations are evolving to match the speed of evolution of cyberthreats. In this session, Jon Amato, Senior Director Analyst at Gartner, discussed the threats and trends affecting security operations and what the outlook for security monitoring is in the future.

Key Takeaways

  • “Cybercrime is very lucrative and rapidly growing and you may end up as one of their clients.”
  • “Unknown or hidden exposures are perceived as less risky because we cannot assess the impact of the risk these have to business.”

  • “To calculate risk, assess how vulnerable, visible and valuable the asset is.”

  • “Ransomware attackers are becoming highly sophisticated in their attacks. They are entrepreneurs who are fine-tuned to make money from the attack.”

  • “Ransomware defense is a verb not a noun. It is a program of activities and not a thing that one can simply go out and purchase.”

  • “Security hygiene when deployed, monitored and managed can make your organization more resistant to threats.” 

  • “While security tools are important, a more holistic strategy is required to plan for effective defense.” 

  • “Respond in a ransomware specific way - you need something that is specific to the particular threat. Have a way to recover.”

  • “Transfer responsibilities to DevOps teams where feasible.or example, vulnerability management, testing, services, threat modeling, but ensure SecOps has an oversight role.”

Vulnerability Management — What Is Working and What Is Not

Presented by Mitchell Schneider, Principal Analyst, Gartner

Vulnerability management is still not a standard practice for many organizations, but it should be a foundational practice of good security hygiene. In this session, Mitchell Schneider, Principal Analyst at Gartner, shared what has and has not worked across people, processes and technologies for organizations implementing a vulnerability management program.

Key Takeaways

  • “If you can move to a situation where your attack surface is so high that only a sophisticated zero-day or an intelligence agency in another country is able to get in, you’ve broken 90% of the threat actors on the internet.”

  • “The goal of vulnerability management is not to patch the most vulnerabilities, but rather to identify and address the threats that are most likely to be exploited against that particular organization.”

  • “Attackers primarily focus on a small number of vulnerabilities that can be reliably exploited at the lowest cost to achieve their outcomes.”

  • “Participation in vulnerability management is hybrid. It does not need a dedicated team residing directly in a security operations center, but rather a combination of stakeholders from various business units who would be able to make decisions at every stage of the vulnerability management process.”

  • “There is no way to manage exposure without proper visibility.”

  • “You cannot boil the ocean. Determine the high-value assets and where critical data is located and focus efforts there.”

It’s not too late to join the conference!

About Gartner

Gartner, Inc. (NYSE: IT) delivers actionable, objective insight to executives and their teams. Our expert guidance and tools enable faster, smarter decisions and stronger performance on an organization’s mission-critical priorities. To learn more, visit


It's not too late to join the conference

Latest Releases