Headline

Michel is professor of cybersecurity at TU Delft. His team studies how organizations and markets handle security risks, focusing on incentives, coordination, and real-world practices that shape how vulnerabilities are prioritized and fixed. His work combines large-scale measurement with organizational analysis to inform policy and improve security in practice.

INHOUD

Compliance for Security or Versus Security? The Messy Reality of Enterprise Cyber Risk Management

Cybersecurity compliance promises control: requirements are defined, evidence is collected, and assurance is produced. Yet organizations can satisfy all of these demands and still end up less secure than intended. Why does this happen? Where does the gap emerge between what compliance can see and what security actually requires? And why can sensible requirements produce surprising effects once they meet real organizations? This keynote looks beneath the apparent order of policies, controls, and audit evidence to examine the messier relationship between compliance and security—and asks what compliance is really optimizing for.