When it comes to CRISC, the hardest part isn't just one risk concept. It is holding them all in head at once: inherent vs. control vs. residual risk, the three-line model, the four domains, the 4 Ts, KRI vs. KCI vs. KPI. So I created something to solve this for the next person. For you!
Read more →Senior Information Security & Risk Management Leader
Máté
Lendvai
Information security · Risk · AI governance · Frankfurt am Main
I help organisations make better decisions when technology is moving faster than they're ready for.
Bring a project, a role, a CISM or CRISC question, or just ask how I work. No prep needed.
My Story
Technology has never been the hardest part. People are.
For more than 20 years, I've navigated change at the intersection of business, information security, IT, governance, and AI. I believe strong leaders create clarity by translating technical challenges into business opportunities. My job is to help people make better decisions, not to be the person who makes decisions for them.
I develop people and solve complex problems. I care about building teams where trust comes before hierarchy. Not because it sounds good, but because I've seen what happens when it doesn't. That principle has guided how I work throughout my career, both professionally and personally.
Outside of work, I play competitive basketball. It's taught me that communication and knowing when to step back matter more than individual performance. I try to bring that into every team I work with.
Today, my focus is the intersection of AI, information security, and risk management. The real advantage will not come from who has the most AI, but from those who can combine it with strong governance and sound decision-making. That's the gap I help organizations close.
- CISMCertified Information Security Manager
- CRISCCertified in Risk & Info Systems Control
- CISSPCertified Information Systems Security Professional
- CDPOCertified Data Protection Officer
- CBCMPCertified Business Continuity Management Professional
- ISO 27001Lead Auditor
- ISO 27701Lead Auditor
- ISO 42001Lead Auditor
- EU GDPRCertified EU GDPR Practitioner
- ISO 22301Lead Implementer
- ISO 9001Foundation
Posts
Thoughts and news on information security, leadership, career - updated regularly.
View all posts on LinkedIn →It's not the certificate itself that's important here, but the acquisition and application of a different perspective in addition to everyday work. It's for such results that I love and find it worth doing this hobby, to be able to coach people/teams for their further development...
Read more →I have cleared the ISO 27701:2025 Lead Auditor certification. My goal is to become more effective at helping and mentoring companies to manage risk, security, privacy, and governance challenges from multiple perspectives...
Events
Speaking engagements, coaching, training, and panel discussions on cyber resilience, risk management, security strategy, and leadership.
Next IT Security
DACH Edition · Frankfurt
26 November 2026
Coming soon…
Event page →Fabulous Tallinn!
I would like to thank the Ericsson team in Estonia for their interest and attention, as well as for the opportunity to share my experiences with them and assist them in preparing for the ISO 22301 audit.
View post →What an adventure!
At the request of The Knowledge Academy, I traveled to Munich to deliver an ISACA CISM course to a team from Zscaler.
View post →Calendar
Where I'm training, coaching and mentoring. Hover over or tap a day to see what's on.
- Training
- Bootcamp
- Coaching
- Mentoring
- On stage
Services
Available for the following services:
CISO · CIO · Enterprise Risk Management
Organizations bring me in when technology is moving faster than their leadership can keep up with. I work as CISO, CIO, or Enterprise Risk Manager to close that gap. I build the governance, the team habits, and the decision-making frameworks that make sure the right calls get made before the wrong ones become expensive.
Coaching · Presenting · Training
I coach individuals and teams preparing for CISM, CRISC and CISSP exams, for GDPR and DPO roles, and for working with DORA, ISO 22301 and RCA techniques. I've done the work and been through the exams myself, so I know where people get stuck, and it's rarely the parts they expect. Sessions are practical, built around your schedule, and focused on passing, not just covering the material.
Security leadership when you need it. Coaching that gets your team certified. Let's talk.
Book a 30-min call → Write to me →Shop
Professional study materials created from my real exam and field experience. These are not a substitute for the official material, but they do help a lot in showing you what you will encounter on the exam. For me, the content of my preparation materials helped me pass the exam.
Want both? The Notes and the Mock Test come as a €22 bundle on either page.
Risk & Information System Control Study Notes (CRISC)
This exam preparation material was made for you for a reason. Because if I had had such a structured and realistic exam expectation summary material, I could have saved more time, energy and money. Learn from my mistake.
Risk & Information System Control Study Notes (CRISC) Mock Test
Based on my study notes, I've created a set of practice questions covering the most important topics, designed to boost your confidence and simulate the actual exam environment. Finally, real questions without filler content, complete with explanations and fully tailored to your needs. This is what will set you apart from the rest.
CRISC Mission Control Infographic
I have prepared a free, concise summary that is an excellent reminder and food for thought. This will "put the picture together" and make you more confident. It contains tips and tricks that reflect the expectations of the exam. A crumb party before the release of the larger "Risk & Information System Control Study Notes (CRISC)".
Uncontrolled
Coming soon
Conversations about security, risk, AI and people, where nobody follows a script.
Controls. Security controls. Risk controls. Access controls. Impulse control? Out of scope.
Something uncontrolled is inherently interesting.
Where security, risk and AI get out of control.
People are unpredictable. Organisations are unpredictable.
Because apparently someone thought giving humans technology was a good idea.