May 13, 2025
From Pilot to Capability: The Journey to Operationalise CRQ
James Hanbury
Global Lead Director, Co-founder

Read the next blog in the series

No items found.
James Hanbury
Global Lead Director, Co-founder
James is the co-founder and Global Lead Director of CRI. He has spent over a decade working with cyber and risk teams, helping them bring more structure and clarity to how cyber risk is measured and communicated. James began building the earliest versions of CRI's models back in 2016, using Excel to explore how organisations could approach cyber risk in a more decision-focused way. That work has since grown into a SaaS-enabled capability now used by clients around the world. Based in London, James continues to work closely with CRI's clients and partners, focusing on how to make cyber risk quantification useful, explainable, and easier to adopt in practice.
Thought Leadership
CRQ in action
From Pilot to Capability: The Journey to Operationalise CRQ

CRQ can’t remain a pilot forever. To drive meaningful, repeatable value, it needs to mature into a business capability: trusted, embedded, and regularly informing decisions.

In this article, I share a four-stage CRQ maturity ladder. Each stage includes key actions to take, potential blockers, and traps to avoid. Together, these offer a roadmap to help CRQ evolve from a promising experiment to a business-critical capability.

We'll cover:

  • Stage 1: Explore and demonstrate value
  • Stage 2: Expand use and build confidence
  • Stage 3: Standardise and operationalise
  • Stage 4: Embed as capability
Get your copy below.
By submitting this form I agree that Cyber Risk Insights may collect, process and retain my data pursuant to its Privacy Policy.
Thank you! Use the button below to read now.
Read now
Oops! Something went wrong while submitting the form.

Summary

Key messages

01

02

03

Thought Leadership
CRQ in action
From Pilot to Capability: The Journey to Operationalise CRQ

CRQ can’t remain a pilot forever. To drive meaningful, repeatable value, it needs to mature into a business capability: trusted, embedded, and regularly informing decisions.

In this article, I share a four-stage CRQ maturity ladder. Each stage includes key actions to take, potential blockers, and traps to avoid. Together, these offer a roadmap to help CRQ evolve from a promising experiment to a business-critical capability.

We'll cover:

  • Stage 1: Explore and demonstrate value
  • Stage 2: Expand use and build confidence
  • Stage 3: Standardise and operationalise
  • Stage 4: Embed as capability
Read now

Summary

Key messages

01

02

03

Recent Insights

Calculating the impact of a cyber-attack on critical infrastructure

What would a systemic cyber-attack cost the UK economy? We recently conducted a study for the Department for Science, Innovation and Technology (DSIT) to answer that question. The findings show the scale of potential disruption and underline why resilience planning matters.
James Hanbury
Blog
Sector insights

Cyber resilience in the North West: turning risk into regional strength

According to the Department for Science, Innovation and Technology (DSIT), over 600,000 UK businesses experiencing some form of cyber‑attack. So, if cyber risk isn’t new, why do impacts keep rising? And what can we do in the North West to change the trend?
Martin Tyley
Blog
Resilience

Making sense of cyber attack costs: A sector by sector view

What might a cyber-attack cost your business? Read more about the patterns we found in research we conducted for the Department for Science, Innovation and Technology (DSIT) – and why those patterns still matter today, even as the threat landscape evolves.
James Hanbury
Blog
Sector insights

See CRI in action

Book a personalised demo and discover how CRI can help you make smarter cyber risk decisions.
Book a demo