Traditional cybersecurity is reactive. It responds to threats as they surface while trying to minimize the chance they will ever be an issue. Yet in an environment of constant change and evolution, this is insufficient. What your business needs to do is approach cybersecurity from the perspective of continuous risk.

Project managers recommend how much should be invested to address various risks based on their understanding of project context, but the final decision about what to do and when those efforts are sufficient belongs to the sponsor. Risk management requires executive input, so sponsors need to see all risk data you have.

Releasing untested defect fixes into production is a real possibility. Being aware of how this can occur may help reduce the possibility of it happening. Let’s explore the common reasons defect fixes go untested—insufficient testing or resources, and undocumented fixes—as well as the steps we can take to prevent them.