Twenty years ago when Acme Corp first started making widgets, things were very different. The hackers were in it for the love of a challenge, not to wreak havoc or collect a paycheck. Our security was in the eye of the beholder and not a product of a checklist presented to us by our auditors on behalf of some regulatory agency. Today, we have so many risks to deal with that it's pretty mind boggling. Thank goodness for Josh and Karen! They were able to create a register of all of our risks to provide visibility and accountability for all areas of the business. Even better, we now have a simple system of prioritizing the most important things to spend our limited resources on. Why aren't more companies using a risk-based approach to security? In this presentation, LARP'ing (Live Action Role-Playing) comes to LASCON as we work together to formulate a plan on how to address the risks in this fictitious, yet oh so realistic, company. In real-time, we will work through the process of assessing our risks, planning our mitigations, and performing reviews with problems, real tools, real people, and real solutions. Every participant should come away with a solid understanding of the fundamentals of risk management, examples of integrating tools into the process, and hopefully a few laughs along the way. We hope to see you there.