About
Patrick M. Hayes
Author, strategist, executive advisor and keynote speaker whose work focuses on Business Survivability, Integrated Assurance and the decisions that determine whether organizations can continue operating through disruption and change.
Patrick's perspective comes from more than 30 years working across executive leadership, enterprise architecture, cybersecurity, operations, governance and risk.
Patrick has spent more than 30 years working across executive leadership, enterprise architecture, cybersecurity, operations, governance and risk. That experience has included building and leading operations, advising executives, designing enterprise security architectures and working with organizations across North America, Latin America, Europe and Asia-Pacific.
Over time, his work increasingly focused on the problems that sit between traditional organizational functions. Cybersecurity, technology, operations, governance and business risk are usually managed separately, even though the decisions made in one area can create consequences somewhere else. That observation became an important part of the thinking behind Integrated Assurance and, more recently, Patrick's work on Business Survivability.
Operating leadership
Patrick's career has been spent inside organizations rather than observing them. Executive leadership, enterprise architecture, operations, cybersecurity and governance roles gave him the unusual vantage point of having been accountable at each layer where risk actually accumulates.
Enterprise architecture
Patrick became a Zachman Enterprise Architect in 2000, took up TOGAF as a second architectural discipline, and became a certified SABSA enterprise security architect in 2011. Together those frameworks taught him to treat an organization as a single interconnected system, in which a decision taken in one part of the business has consequences in others. That way of seeing the enterprise underpins much of his thinking about Integrated Assurance.
Engineering and threat management
Patrick designed, architected and launched four security operations platforms, including SIEM, MDR and ASM capabilities, and built several security operations centers across North America, EMEA and APAC. The work turned architectural intent into systems that run and teams that watch them, and it brought him close to the distance between a control that exists on paper and one that performs when it is tested.
Assurance and governance
Across dozens of assessments in government, media, telecommunications, finance and manufacturing, Patrick has modeled organizational maturity using frameworks such as NIST CSF, NIST 800-53, ISO 27001 and ESRM, and has led FedRAMP efforts for technology companies seeking growth in servicing the US Federal Government. That mix of assessment, audit and executive reporting work surfaced a consistent pattern: individually capable functions produced partial views, and leadership was left to reconcile them at the moment a decision was required. Integrated Assurance came out of that experience.
Research and writing
Patrick's research and writing turned that experience into a more formal body of work. Integrated Assurance: Unified Risk Strategy introduced the operating model, Relevant Impact: A Field Guide to Integrated Assurance explored its practical application, and Can We Insure This? extended the discussion into cyber risk, AI, insurance and Business Survivability.
Beyond the work
Patrick writes regularly because writing gives him a way to work through ideas that often begin in conversations with executives, business owners and other practitioners. Speaking serves much the same purpose. The questions that come from an audience frequently become the starting point for the next article, framework or book.
He lives in the western United States and spends as much time outdoors as his schedule allows. Away from work, he'd generally rather be outside than behind another screen.
Patrick’s Integrated Assurance work includes the Integrated Assurance Maturity Model (IAMM®), which examines how that enterprise capability develops across six organizational domains.
Selected Publications
Managing Risk When AI Changes How We Make Decisions
Risk Society ·
As AI becomes part of everyday business decisions, leaders need to consider how that changes their ability to understand and oversee the choices being made. An AI recommendation can influence a business outcome long before anyone formally delegates authority to the technology. The organization still carries responsibility for the consequences, even when the reasoning behind a decision becomes harder to see.
Read articleThe Insurance Industry Is Rewriting Cybersecurity Strategy
Cyber Defense Magazine ·
Read articleThe Cybersecurity Talent Paradox
Cyber Defense Magazine ·
Read articleThe New vCISO Mandate
Cyber Defense Magazine ·
Read articleAI is the New Attack Surface - What CISOs Must Know
Cyber Defense Magazine ·
Read article
Continue the conversation
Patrick writes and speaks regularly about Business Survivability, Integrated Assurance, AI, cybersecurity, risk, and the decisions that shape how organizations operate.