What to Watch: Mapping Risk Priorities Using ESRM
Closing reflections on GSX 2026
I close my GSX 2026 series with a session that means a lot to me: “What to Watch: Mapping Risk Priorities Using ESRM.” One of its speakers, Antonio Bellorin, is a good friend and a former client from our time working together at British American Tobacco in Venezuela. Today, he serves as Chief Security Officer at Tecnológico de Monterrey in Mexico.
That personal connection made this session special. Its substance made it a fitting place to end the series.
The discussion addressed a question familiar to security leaders: when threats keep multiplying, how do we decide which ones deserve our attention? Through Enterprise Security Risk Management, or ESRM, the panel explored how to connect security priorities to organizational objectives, establish clear ownership, and build the relationships needed to make informed decisions.
My strongest takeaway was that meaningful risk prioritization begins with understanding what people are trying to achieve.
Start with the objectives
Antonio described an enterprise whose activities extend across education, healthcare, research, and other operations. Within that environment, security priorities include people’s safety, travel, continuity, regulatory exposure, and reputation. Each institution has different responsibilities and different consequences when something goes wrong.
A useful risk conversation must account for those differences.
Antonio’s approach starts with the people responsible for the objectives and processes. They understand daily operations, recognize constraints, and often sense emerging problems before they appear in a formal report.
His account of building a security function at Reckitt illustrated this well. The opening questions focused on what colleagues were doing, what their annual plans required, and what might keep them from succeeding. Those conversations revealed recurring cargo losses and travel concerns that had become accepted parts of doing business.
The lesson is practical: security earns attention when it helps people address problems they recognize. As those problems are resolved, colleagues become more willing to share information. That creates a stronger foundation for identifying the next risk.
Trust determines what security gets to know
Trust was a recurring theme across the panel. A stakeholder map can identify the people security needs to engage, but the quality of those relationships determines how much useful information will emerge.
People may disclose only part of a concern. They may assume security already understands a process. They may have normalized a recurring loss or believe that reporting it will accomplish little.
Listening carefully, asking informed questions, and delivering useful support can change that.
The panel’s supply chain examples showed why this matters. An organization may have little direct presence in a disrupted location and still depend on components moving through it. Without a clear understanding of those dependencies, an intelligence report can miss the most important operational consequence.
For me, this is one of the session’s most valuable observations. Security intelligence becomes useful when someone can explain how an event affects a particular operation, decision, or objective.
Priorities need shared criteria
Even with good relationships, security leaders face competing demands. Several stakeholders can have legitimate concerns at the same time, while resources remain limited.
Antonio described three prioritization considerations: impact, exposure, and velocity.
Impact concerns the consequences for people, continuity, and reputation. Exposure concerns the vulnerabilities and conditions that make those consequences possible. Velocity concerns how quickly the situation is developing and how much time remains to act.
These considerations help turn a broad concern into a decision about urgency.
The panel also discussed the value of agreeing on impact definitions before an incident occurs. One example involved a five-level impact table covering people, property, and operations. Shared definitions give stakeholders a basis for discussing severity and allocating resources.
Those definitions also need to remain open to challenge. When a stakeholder’s reaction appears much stronger than the assessed risk, security should investigate the gap. The assessment may have overlooked an operational dependency or consequence.
A framework becomes more useful as the organization learns from applying it.
Ownership must remain clear
Antonio’s explanation of governance reinforced a central ESRM principle: the people accountable for organizational objectives must participate in decisions about the risks affecting them.
Security contributes intelligence, methodology, mitigation options, and enterprise-wide visibility. Operational leaders contribute knowledge of their activities and responsibility for the decisions within their authority.
His description of presenting institutional risk profiles alongside the relevant risk owners made that accountability concrete. The conversation includes the leaders who must explain the exposure and the proposed response.
This approach requires information to move in both directions. Enterprise leadership provides strategic direction; operational teams provide the detail needed to understand what is happening in practice.
Antonio also offered a candid reflection on what he would do differently: listen to strategic leaders and operational teams in parallel. Hearing both perspectives early helps security better understand the organization and test assumptions before they become embedded in its priorities.
Attention is a limited resource
The session returned repeatedly to the pressure of managing too many concerns at once. Prioritization requires deciding which risks need immediate intervention and which can remain under routine monitoring.
Lower-priority risks still need clear ownership and conditions for escalation. Their status can change as exposure grows, consequences become clearer, or events accelerate.
Leaders also need information suited to their decisions. Reporting every development with equal urgency makes it harder to recognize the developments that demand action. Clear thresholds help people understand when to respond locally, when to escalate, and what leadership needs to know.
The panel’s closing reflections brought this discipline back to the individual. The discussion highlighted exercise, family time, and focusing on the next manageable problem. Sustaining sound judgment also requires attention to the person making the decisions.
A personal closing reflection
I am pleased to close this series with Antonio’s contribution. Our friendship and our professional connection through British American Tobacco in Venezuela give this article a personal significance. His perspective at Tecnológico de Monterrey also brings the discussion into an environment where security decisions affect learning, healthcare, and the daily lives of a diverse community.
The session leaves me with a clear question for security leaders to carry into their next conversation:
What are you trying to achieve, and what could prevent you from achieving it?
Listening closely to the answer is where useful risk prioritization begins. It is also a fitting thought with which to close my GSX 2026 series.