How GRC and Red Teaming Work Together to Reduce Cyber Risk

Summary

Black Hills Information Security speakers discuss how governance, risk and compliance assessments complement penetration testing, with examples involving access controls, MFA, incident response and remediation.

Key points

• GRC establishes requirements and supports management action, while penetration testing checks whether technical controls work in practice.
• The speakers recommend reviewing access provisioning, privilege changes and password reuse rather than relying solely on password complexity requirements.
• MFA is a security layer, not a guarantee: the discussion covers gaps in deployment, phishing through transparent proxies and repeated push notifications.
• GRC reviews can assess incident response, business continuity and supplier risk that a scoped penetration test may not cover.
• The speakers recommend exercising response plans beyond tabletop discussions and using test findings in risk assessments to support remediation and funding.
• For phishing awareness, they advise treating unexpected messages cautiously, verifying sensitive requests and reinforcing employees who report suspicious messages.

People