Risiko内容量 Ditulis, Per Collectively Digubah: Wajar ke عدam穿梭?

A common image of InfoSec risk management is a security specialist staring at a screen, hunting vulnerabilities and protecting systems. The people doing the job describe something less cinematic: calendars, findings, conversations and the long pursuit of evidence.

A typical week can begin by deciding which meeting needs to happen, then preparing it, agreeing on attendees and following up afterward. Technical work may account for only 10 to 20% of the day. Much of the remaining time goes to system owners, engineering, legal teams and procurement specialists.

Read nextJURANG SIBER: Bolehkah Startup Baharu Menyelamatkan Pasukan Keselamatan?

The central question is rarely just whether a vulnerability exists. It is what could happen, how serious the impact would be, what treatment would cost and who owns the decision. Findings must be documented, added to a register and revisited months later to see whether anyone actually fixed the issue.

This is where the work becomes political. One former cyber consultant arrived in-house expecting to find and treat risks. Instead, teams were fighting over budgets, headcount and importance. Some increased the visibility of a risk to secure more resources; others wanted to weaken a competitor. A technical label became a tool for organizational influence.

The same problem appears after launch. A product team builds something new, celebrates the release and moves on to the next bright feature. Patching and maintenance are left behind. Security staff must chase the evidence while the business celebrates the shiny new thing.

Some practitioners say the documents become strategic tools. A response prepared for an auditor can be carefully framed to make a serious condition sound less serious. That may not be fabrication, but it can create a distance between the official report and the lived risk. One veteran described the overall work as thankless, exhausting and like swimming upstream.

The strongest defense of the profession is not that every meeting is valuable. It is that risk decisions require context. A system owner may know the cost of downtime; legal may understand liability; engineering may know whether a control is realistic. Security can connect those facts. A good decision is one in which the business understands the tradeoff and accepts the consequence with open eyes, rather than simply hearing “no” from a specialist with no explanation.

The work also changes by sector. Government, military, healthcare and finance are heavily regulated. Security categories and policy instruments are often already established, so the challenge is applying them consistently. Private organizations may have a higher risk appetite, but they need senior-management support to avoid reckless decisions.

The most damaging criticism is that risk management can become attribution rather than mitigation. A risk is handed to the person with the weakest reason not to be responsible. Policies are written, but adoption is uncertain. The document exists; the practical control does not.

That is why one practitioner moved to cyber incident response. The role returns them to hunting human attackers, handling other people’s mistakes and receiving thanks when they stop an active threat. Nearly half of the work is technical again. Their advice is simple: do not lose touch with technology, or engineers will eventually stop trusting the security function.

The episode’s second subject creates a sharp contrast. While teams debate who should own a risk, Apple A20 Pro is reported to beat Snapdragon 8 Gen 6 Extreme by 38% in the ray-tracing-heavy Solar Bay Extreme benchmark. The Adreno 850 can win lighter ray-tracing and rasterized tests, but Apple’s stronger acceleration wins the heavier workload.

The technical explanation points to missing features such as hardware BVH traversal, Shader Execution Reordering and hardware-accelerated Micropacity Maps. Matrix Accelerators are a major step, but newer instruction sets such as SME2 would make a flagship price harder to defend. The impact is small today, though it could grow in future games and in PC ray-tracing emulation such as Doom: The Dark Ages.

The podcast’s verdict is not whether risk is ever accepted. It is whether ownership and evidence make acceptance responsible, or whether the system has merely learned how to distribute blame.

Dunia Digital’s hosts will dig into this risk-management debate and the processor comparison on the podcast.