Information security professionals believe they are moving towards a more pro-active, risk-based approach to securing their organisations and away from just IT and technology-related activities. This is one of the key findings in a study by the Information Security Forum (ISF) looking at the Role of Information Security in the Enterprise (RISE).