May 13, 2025

From Pilot to Capability: The Journey to Operationalise CRQ

James Hanbury

Global Lead Director, Co-founder

Read the next blog in the series

No items found.

James Hanbury

Global Lead Director, Co-founder

James is the co-founder and Global Lead Director of CRI. He has spent over a decade working with cyber and risk teams, helping them bring more structure and clarity to how cyber risk is measured and communicated. James began building the earliest versions of CRI's models back in 2016, using Excel to explore how organisations could approach cyber risk in a more decision-focused way. That work has since grown into a SaaS-enabled capability now used by clients around the world. Based in London, James continues to work closely with CRI's clients and partners, focusing on how to make cyber risk quantification useful, explainable, and easier to adopt in practice.

Thought Leadership

From Pilot to Capability: The Journey to Operationalise CRQ

CRQ can’t remain a pilot forever. To drive meaningful, repeatable value, it needs to mature into a business capability: trusted, embedded, and regularly informing decisions.

In this article, I share a four-stage CRQ maturity ladder. Each stage includes key actions to take, potential blockers, and traps to avoid. Together, these offer a roadmap to help CRQ evolve from a promising experiment to a business-critical capability.

We'll cover:

Stage 1: Explore and demonstrate value
Stage 2: Expand use and build confidence
Stage 3: Standardise and operationalise
Stage 4: Embed as capability

Get your copy below.

Thank you! Use the button below to read now.

Read now

Oops! Something went wrong while submitting the form.

Summary

Key messages

01

02

03

Thought Leadership

From Pilot to Capability: The Journey to Operationalise CRQ

CRQ can’t remain a pilot forever. To drive meaningful, repeatable value, it needs to mature into a business capability: trusted, embedded, and regularly informing decisions.

We'll cover:

Stage 1: Explore and demonstrate value
Stage 2: Expand use and build confidence
Stage 3: Standardise and operationalise
Stage 4: Embed as capability

Read now

Summary

Key messages

01

02

03 Recent Insights

Are your cyber metrics giving you a false sense of security?

Is your organisation primarily using a traffic light system (red, amber, green) to manage cyber risk? You could be overlooking a crucial dimension of risk management.

Elizabeth Huthman

Blog

5 lessons from the frontline: What UK retailers can learn from 2025’s ransomware attacks

As UK retailers made the press in a series of cyber-related incidents a familiar question surfaced again from colleagues - “Do we have a summary of key themes we can share with clients to support cyber conversations?”

Martin Tyley

Blog