With information security attacks becoming more sophisticated by the day, it has become increasingly difficult for organizations to stay ahead of threats. So, telling senior management that company information and systems are secure is potentially career limiting. While there are no silver bullets, moving an information security program toward risk management is important for a few reasons: it addresses guidance being given to boards of directors; it enables alignment to the business; and it helps information security practitioners to focus on what matters most. This presentation will discuss the importance of risk management as well as ideas about how to transform an organization to be a risk-focused culture.