RSAC 2025: The New Cyber Risk Narrative

Leading the shift from reactive compliance to business-aligned resilience

Coming out of the RSA Conference 2025, one thing is clear: the cybersecurity risk narrative has fundamentally shifted — from reactive compliance to business-aligned resilience. And the market has taken note. Both Forrester’s analysis and my own reflections in the FAIR Institute blog confirm it: this year marked a turning point for how cyber risk is understood, managed, and operationalized.

Let’s unpack the three biggest shifts — and how they directly validate the SAFE product strategy.

Author Nicola (Nick) Sanna, Is Founder of the FAIR Institute & President of SAFE

1. From “Cybersecurity Metrics” to “Material Risk Decisions”

Gone are the days of security metrics divorced from business value. Boards, regulators, and business leaders now demand quantifiable answers to questions like: How much risk are we carrying? What’s the financial impact? Are we doing enough?

Why it matters:
As Forrester puts it, “CISOs can no longer hide behind a veil of techno-babble.” The industry is aligning around materiality, measurable risk reduction, and resilience.

How SAFE is leading:
The SAFE platform was built from day one to manage cyber risk from the business perspective — and now extends that to the entire digital ecosystem: internal systems, third parties, and AI models. SAFE transforms technical telemetry and assessments into actionable insights, based on open standards and tuned for business-aligned decisions.

2. CRQ Is Dead. Long Live Continuous, Connected CRQ

The original concept of CRQ — periodic, manual assessments — is no longer sufficient in a world where risk changes daily. The future belongs to continuous, autonomous , and AI-driven CRQ across all risk domains.

Why it matters:
As I wrote in the FAIR Institute blog, the acronym CRQ isn’t going away — but its meaning has evolved. The winners in this new era will be those who can automate, operationalize, and connect CRQ to real-time business outcomes.

How SAFE is leading:
We’ve moved beyond point-in-time quantitative risk assessments. SAFE offers Continuous Cyber Risk Management for enterprise, third-party, and AI risks — powered by Agentic AI that measures, prioritizes, and recommends treatments in real time. Our customers aren’t just identifying risks; they’re reducing them continuously and achieving resilience targets with defensible evidence to prove it.

According to Forrester, of RSAC’s 535-plus open conference sessions, more than one-third prioritized risk-centric topics. Read Forrester’s report.

3. Risk Management as a Growth Enabler, Not a Bottleneck

The narrative has shifted from cyber as a blocker to cyber as a business accelerator. With new regulations — including SEC and NYDFS in the US, and DORA and NIS2 in the EU — pressing firms to strengthen cyber risk management and to demonstrate “adequate (cybersecurity) care” and cyber resilience, organizations that can confidently scale with embedded risk intelligence will outpace those that can’t. These regulations also emphasize that third-party risk management must be in scope, given today’s extended digital supply chains.

Why it matters:
Companies are tired of vendor assessments that take months and deliver little value. As the Forrester piece notes, legacy cyber risk and TPRM tools are giving way to integrated, AI-powered solutions that can scale without additional headcount.

How SAFE is leading:
SAFE is pioneering Agentic AI for TPRM — the industry’s first truly autonomous third-party risk platform. It automates the full lifecycle: onboarding, due diligence, assessing risk, continuous monitoring, and even contract intelligence. SAFE’s specialized AI Agents free up teams to focus on high-value decisions, not repetitive tasks.

TPRM on the SAFE platform

Final Word: The Risk Singularity Is Here

What we saw at RSAC 2025 wasn’t just product innovation — it was narrative reinvention. Risk leaders are no longer content with slow, siloed, or shallow assessments. They’re demanding real-time, financially-aligned, AI-powered solutions that scale with the business.

At SAFE, we believe this is the dawn of the Cyber Risk Singularity — when visibility, action, and impact converge across your entire attack surface — enterprise, third-party, and AI.. The RSA Conference validated that belief. The market is catching up. SAFE is already there.

Let’s keep building.

Want to see what Agentic AI for TPRM looks like in action? Schedule a Demo