Biography
Tracey Forney is a cybersecurity risk and third-party risk management executive with more than 25 years of experience leading security, governance, compliance, technology risk, and vendor risk programs in highly regulated environments. She specializes in transforming complex cybersecurity and technology risks into clear business priorities that strengthen resilience, support strategic decision-making, and enable organizations to manage risk with confidence.
Throughout her career, Tracey has built and scaled enterprise security assessment and third-party risk management programs, developed risk-based control frameworks, and led multidisciplinary teams responsible for evaluating complex technology environments. Her expertise spans cybersecurity risk governance, third-party and supply chain risk management, security assessments, cloud and infrastructure risk, risk appetite and tolerance, regulatory alignment, risk acceptance, and remediation strategy.
As Vendor Manager for Security Assessment & Third-Party Risk Services at Aerstone, Tracey leads a team of security risk professionals delivering independent, risk-based technology and cybersecurity assessments. She is also developing and launching a third-party risk management service offering designed to connect vendor risk, business priorities, regulatory expectations, and organizational risk appetite. Her leadership focuses on creating consistent and defensible risk decisions while improving collaboration among business, technology, cybersecurity, and risk stakeholders.
Previously, Tracey served in senior technology and cybersecurity risk leadership within the Federal Reserve System, where she led more than 50 direct and indirect resources across multiple districts. She developed a risk-based control framework that reduced assessment cycle time by 40% while increasing focus on high-impact technology risks. She also partnered with technology, cloud, and infrastructure leaders on major transformation initiatives and provided executive reporting that translated technical vulnerabilities and control weaknesses into business and operational risk.
Earlier in her career, Tracey established and strengthened cybersecurity governance and third-party risk programs at Rocket Central, Integris Security Solutions, and Progressive Insurance. At Progressive, she founded the organization’s third-party cyber and technology risk assessment program and led enterprise risk activities spanning vendor assessments, PCI compliance, penetration testing, governance, and GRC technology.
A collaborative and strategic leader, Tracey is known for bringing cybersecurity, technology, business, compliance, and enterprise risk teams together around a collective understanding of risk. Her leadership philosophy centers on moving organizations beyond compliance toward resilience—building risk programs that anticipate disruption, strengthen critical dependencies, and enable informed executive decision-making.
Tracey holds certifications in Third-Party Risk Assessment, Risk and Information Systems Control, and Governance, Risk and Compliance.
Leadership Characteristics
Tracey is a strategic, collaborative, and resilient leader who brings people together to navigate complex challenges, transform cybersecurity and technology risk into meaningful business insights, and drive sustainable change.
Known for creating clarity in uncertainty, she builds trusted partnerships across business, technology, and risk teams while developing scalable programs that strengthen organizational resilience. Her leadership enables executives to make confident, risk-informed decisions while balancing business priorities, innovation, and responsible risk management.
Leadership Challenges
Throughout her career, Tracey has faced leadership challenges that required her to grow beyond technical expertise and become a more adaptable, collaborative, and resilient leader.
One of her greatest challenges has been leading through change and uncertainty. Organizational transformations, changing leadership expectations, emerging risks, and evolving business priorities often required her to make decisions without having every answer. She learned to remain focused on the larger objective while adjusting the path when circumstances changed.
Another challenge has been building alignment among people with different priorities and perspectives. Technology, cybersecurity, risk, compliance, and business leaders do not always view risk in the same way. Tracey learned that successful leadership requires listening first, understanding different perspectives, and finding common ground before attempting to drive change.
She has also experienced the challenge of leading large and diverse teams while maintaining consistency and trust. Managing professionals with different backgrounds, experiences, working styles, and levels of expertise taught her that leadership cannot be one-size-fits-all. People need clarity and accountability, but they also need to feel valued, supported, and empowered.
Driving change in established environments has been another significant challenge. Introducing new programs, processes, and ways of thinking can create resistance. Tracey learned that having the right solution is not enough; leaders must communicate the purpose behind the change, build credibility, engage stakeholders, and give people an opportunity to become part of the solution.
She has also had to navigate difficult decisions and competing priorities. Leadership sometimes requires making decisions that will not satisfy everyone. These experiences taught her to be thoughtful and decisive, communicate transparently, and remain accountable for the outcome.
These challenges have shaped Tracey into a leader who values resilience, collaboration, accountability, empathy, adaptability, and continuous growth. Rather than viewing challenges as barriers, she has learned to use them as opportunities to strengthen both herself and the people she leads.
Key Take-a-ways
Challenges may change the path, but they do not have to change the purpose. Resilience is the ability to adapt, learn, and keep moving forward while helping others do the same.
Additionally, effective leadership does not require having all the answers. It requires asking the right questions, surrounding yourself with capable people, listening to perspectives different from your own, and creating an environment where people are comfortable speaking up.
Fun Fact
Tracey loves baking and creating little bundles of homemade happiness for friends and family.
Tracey is actively engaged in working with non-sheltered individuals and creating safe, warm, places of trust for people at risk.