Astrid Yee-Sobraques

In late 2025, a breach notification letter arrived from an outsourcing company the recipient had never engaged, about data it had never knowingly shared with the sender. The notice came from Conduent, which processes data on behalf of health insurers across 46 states. The intrusion had gone undetected for nearly three months and taken 11 months to generate a notification.

Enterprise Risk Management (ERM) was built around the foundational concept of institutional risk – the risk of who we deal with. Credit risk, counterparty risk, third-party risk each asks some version of the same question: Is this entity safe to transact with? That architecture has a structural blind spot: Infrastructure risk – the risk of how the value moves.

When CrowdStrike’s software update triggered the largest IT outage in history in July 2024, organizations discovered they had no visibility into enterprise exposure. When UnitedHealth acquired Change Healthcare, no cybersecurity posture assessment was conducted during the M&A due diligence process.