Risk and Resilience on Hector Herrerahttps://www.hectorherrera.pro/en/categories/risk-and-resilience/Recent content in Risk and Resilience on Hector HerreraHugoen-USFri, 07 Aug 2026 17:40:00 -0500Designing an email protection capability against phishing, fraud, and critical-process compromisehttps://www.hectorherrera.pro/en/work/designing-email-protection-capability-critical-business-processes/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/designing-email-protection-capability-critical-business-processes/Structuring an email protection capability focused on detecting phishing, fraud, impersonation, and other interactions capable of compromising critical business processes.Designing an operational model for cybersecurity incident managementhttps://www.hectorherrera.pro/en/work/designing-operational-model-cybersecurity-incident-management/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/designing-operational-model-cybersecurity-incident-management/Structuring an incident management operating model that connects governance, roles, playbooks, evidence, communications, exercises, metrics, and continuous improvement.From vulnerabilities to priorities: designing a context-based RBVM approachhttps://www.hectorherrera.pro/en/work/designing-context-based-exposure-vulnerability-prioritization/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/designing-context-based-exposure-vulnerability-prioritization/An RBVM approach connecting data quality, asset criticality, exposure, severity, threat, controls, remediation constraints, ownership, and residual risk.From tools to capabilities: designing a cybersecurity decision modelhttps://www.hectorherrera.pro/en/work/from-tools-to-capabilities-cybersecurity-decision-model/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/from-tools-to-capabilities-cybersecurity-decision-model/An approach for moving away from isolated product-centered cybersecurity decisions and toward capabilities the organization needs to execute.Having 10,000 vulnerabilities does not mean having 10,000 prioritieshttps://www.hectorherrera.pro/en/ideas/having-10000-vulnerabilities-does-not-mean-having-10000-priorities/Fri, 07 Aug 2026 17:40:00 -0500https://www.hectorherrera.pro/en/ideas/having-10000-vulnerabilities-does-not-mean-having-10000-priorities/Vulnerability management creates value when it turns thousands of findings into a manageable number of decisions that can be executed, validated, and explained.What information is missing when a vulnerability only has a CVSS scorehttps://www.hectorherrera.pro/en/ideas/what-information-is-missing-when-a-vulnerability-only-has-cvss/Fri, 07 Aug 2026 17:30:00 -0500https://www.hectorherrera.pro/en/ideas/what-information-is-missing-when-a-vulnerability-only-has-cvss/A CVSS score can tell us a great deal about a vulnerability and very little about what an organization should do first.Incident response starts before the incidenthttps://www.hectorherrera.pro/en/ideas/incident-response-starts-before-the-incident/Fri, 07 Aug 2026 16:40:00 -0500https://www.hectorherrera.pro/en/ideas/incident-response-starts-before-the-incident/Response capability is built before the incident: by defining decisions, channels, scenarios, evidence, communications, and exercises that reduce unnecessary improvisation.An incident response plan nobody can execute is not really a planhttps://www.hectorherrera.pro/en/ideas/an-incident-response-plan-nobody-can-execute-is-not-really-a-plan/Fri, 07 Aug 2026 16:35:00 -0500https://www.hectorherrera.pro/en/ideas/an-incident-response-plan-nobody-can-execute-is-not-really-a-plan/A plan creates value when a team can activate it under pressure: people know who decides, what to record, what to preserve, how to escalate, and when to close.Email is not just a channel: it is an attack surface against critical business processeshttps://www.hectorherrera.pro/en/ideas/email-is-not-just-a-channel-attack-surface-critical-business-processes/Fri, 07 Aug 2026 15:20:00 -0500https://www.hectorherrera.pro/en/ideas/email-is-not-just-a-channel-attack-surface-critical-business-processes/A convincing email can alter a decision, capture credentials, or redirect a critical process without looking like a traditional attack.Prioritizing risk is not sorting vulnerabilitieshttps://www.hectorherrera.pro/en/ideas/prioritizing-risk-is-not-sorting-vulnerabilities/Fri, 07 Aug 2026 13:30:00 -0500https://www.hectorherrera.pro/en/ideas/prioritizing-risk-is-not-sorting-vulnerabilities/Good prioritization connects exposure, impact, context, and execution capacity; it is not just a technical ranking exercise.Resilience starts before the incidenthttps://www.hectorherrera.pro/en/ideas/resilience-starts-before-the-incident/Fri, 07 Aug 2026 13:20:00 -0500https://www.hectorherrera.pro/en/ideas/resilience-starts-before-the-incident/Responding well matters, but resilience depends on earlier decisions about capabilities, dependencies, recovery, and learning.